CVE-2026-81426

Name of the Vulnerable Software and Affected Versions WC Vendors versions prior to 2.7.2.1

Description Certain front-end order shipment status actions lack Cross-Site Request Forgery (CSRF) protection. CSRF is a type of attack that tricks a logged-in user into executing unwanted actions on a web application. This flaw allows attackers to force a logged-in vendor to change the shipment status of their own orders by using a specially crafted request.

Recommendations Update WC Vendors to version 2.7.2.1 or later.