CVE-2026-127207

Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc support get and sc support save AJAX actions due to the absence of capability and nonce checks in SCCSP Support Controller. Attackers can call these wp ajax handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION ID, SERVICE POINT, CARRIERS, and MIN LOG LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760.