CVE-2026-127207

CVSS 5.4 (medium) · published 2026-11-12

Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760.

Weakness: CWE-862

Source: NVD CVE-2026-127207

References

• https://hackmd.io/@buiih/HJ39N1-0Mx
• https://wordpress.org/plugins/sendcloud-connected-shipping/
• https://www.vulncheck.com/advisories/sendcloud-for-woocommerce-missing-authorization-via-ajax-actions

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.