CVE-2026-103337: Missing Authorization in Kirillbdev WC Ukraine Shipping

The vulnerability identified as CVE-2026-103337 affects the Kirillbdev WC Ukraine Shipping plugin for WooCommerce. It is a missing authorization issue where access control is improperly configured, allowing users with low privileges to perform unauthorized actions that impact data integrity. The affected versions are all releases prior to 1.23.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with low privileges can exploit this vulnerability to modify data without proper authorization, potentially compromising the integrity of the affected system. There is no impact on confidentiality or availability according to the CVSS vector. This could lead to unauthorized changes in shipping configurations or related data within the WooCommerce environment using the WC Ukraine Shipping plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix link is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to trusted users and review permissions related to the WC Ukraine Shipping plugin to minimize risk.