Description
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Fast Courier | ≤ 5.2.3 | — |
References
- https://wpscan.com/vulnerability/716b6d58-a816-43f2-8a1a-b9fe4f2f9d1d/ exploit vdb-entry technical-description