melhorenvio vulnerabilities and threats

CVE-2026-54804 is a high-severity authentication bypass vulnerability affecting Melhor Envio versions up to and including 2.16.3. It involves broken authentication that allows an attacker to bypass normal authentication mechanisms using an alternate path or channel. The vulnerability impacts confidentiality, integrity, and availability to varying degrees. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information, plugin tokens, shipping configurations, and limited vendor information.