medium5.3
CVE-2026-89289
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated at…
Impact
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
Affected products
| Product | Affected versions |
|---|---|
| Fast Courier WordPress Plugin | through 5.2.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.