This vulnerability (CVE-2026-65501) in Shiptastic for WooCommerce (<= 5.1.0) is classified as CWE-639, an authorization bypass through user-controlled key leading to Insecure Direct Object References (IDOR). It allows unauthenticated attackers to access resources or data they should not be authorized to view by exploiting improper access control mechanisms. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality with no impact on integrity or availability.

An attacker can exploit this vulnerability remotely without authentication to gain unauthorized read access to certain data within the affected plugin. The impact is limited to confidentiality loss; integrity and availability are not affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected plugin or implementing additional access controls at the application or network level to limit exposure.