CVE-2026-81426: CWE-352 Cross-Site Request Forgery (CSRF) in WC Vendors

The WC Vendors WordPress plugin prior to version 2.7.2.1 does not implement Cross-Site Request Forgery (CSRF) protections on some front-end order shipment status actions. This absence of CSRF protection allows an attacker to craft a request that, when executed by a logged-in vendor, changes the shipment status of their own orders without their explicit consent. The vulnerability is identified as CWE-352 and has a CVSS 3.1 base score of 4.3, reflecting a medium impact primarily on integrity with no confidentiality or availability impact. There is no vendor advisory or patch information currently available to confirm remediation status.

An attacker can cause a logged-in vendor to unknowingly change the shipment status of their own orders by exploiting the lack of CSRF protection. This impacts the integrity of order shipment data but does not affect confidentiality or availability. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links or requests while logged in as a vendor. No official remediation or temporary fixes are documented in the provided data.