CVE-2026-8678

Name of the Vulnerable Software and Affected Versions MyParcel versions prior to 4.25.2

Description The MyParcel plugin for WordPress contains an authorization bypass that allows authenticated users with subscriber-level access or higher to view and modify shipment options on any arbitrary order. This includes details such as carrier, delivery type, package type, number of labels, weight, signature requirement, and insurance. The issue occurs because the plugin fails to properly verify user authorization when processing the wcmp get shipment options and wcmp save shipment options AJAX actions.

Recommendations Update the plugin to a version newer than 4.25.1. As a temporary mitigation, restrict access to the wcmp get shipment options and wcmp save shipment options AJAX actions for users with subscriber-level permissions.