Skip to content
Sign in
5.3 Medium

CVE-2026-89289 The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order…

Description

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

Affected products and versions

Product Affected versions Fixed in
Fast Courier 5.2 earliest → 5.2.3 No fix stated

Other CVEs of Fast Courier

The 2 CVEs of Fast Courier →
CVE-2026-89288 The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on… 8.6 High
Track this CVE