The Joovii Sendle Shipping plugin suffers from a Missing Authorization vulnerability identified as CVE-2025-62976. This issue allows unauthenticated users to access certain functionality that should be protected by ACLs, potentially leading to denial of service or other availability impacts. The vulnerability affects versions up to 6.02. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and only an impact on availability. No patch or official remediation guidance is currently available.

The vulnerability allows unauthorized access to functionality that should be restricted, which may lead to availability disruption of the Sendle Shipping plugin. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin functionality where possible and monitor for updates from Joovii. Avoid exposing the vulnerable plugin to untrusted users.