CVE-2026-81427

Name of the Vulnerable Software and Affected Versions WC Vendors versions prior to 2.7.2.1

Description An issue exists where the plugin fails to verify if the vendor submitting a front-end order shipment status change is the actual owner of the referenced order. This allows any authenticated vendor to mark orders belonging to other vendors as shipped, create order notes falsely attributed to another vendor, and trigger shipment notification emails to customers.

Recommendations Update WC Vendors to version 2.7.2.1 or later.