CVE-2026-89289CWE-862broken-access-control

CVE-2026-89289

Medium · published October 6, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-06T11:16Z
References (1)
https://wpscan.com/vulnerability/716b6d58-a816-43f2-8a1a-b9fe4f2f9d1d/ · [email protected]
EPSS history
Timeline
  • 07 OCT 03:43Z
    EPSS moved — → 0%
    epss
  • 06 OCT 06:00Z
    Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
    cvelistv5