Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Sendcloud | Sendcloud for WooCommerce: Automated Shipping, Branded Tracking & Returns | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 12 Nov 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760. | |
| Title | Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-12T20:48:13.864Z
Reserved: 2026-11-12T16:30:10.903Z
Link: CVE-2026-127207
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-12T21:17:22.740
Modified: 2026-11-12T21:36:06.743
Link: CVE-2026-127207
Redhat
No data.
OpenCVE Enrichment
No data.