CVE-2026-8678
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.25.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers with subscriber-level access and above to view and modify shipment options on any arbitrary order.
Risk Assessment
The organization is at risk of unauthorized access to shipping data and manipulation of shipment settings, which could lead to financial losses, delivery delays, and breach of customer data confidentiality.
Recommendation
Immediately update the MyParcel plugin to the latest available version that includes a security fix. If an update is not available, temporarily restrict plugin access to trusted administrators only.
Related vulnerabilities
- CVE-2026-77524Critical
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential; the JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, allowing the attacker to obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations.
- CVE-2026-76519CriticalActively exploited
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. It is due to improper handling of email attachments when the file reputation service is enabled; an attacker could send an email with a crafted attachment through an affected device, potentially allowing arbitrary file writes and command execution with root privileges.
- CVE-2026-33796Critical
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.
- CVE-2026-33792Critical
A stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.
- CVE-2026-33789Critical
A stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.
- CVE-2026-109439Critical
A missing authentication vulnerability in Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.
- CVE-2026-102182Critical
A stack-based buffer overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue affects Junos OS on MX Series in versions before 21.2R3-S11, from 21.4 before 21.4R3-S12, from 22.2 before 22.2R3-S8, from 22.3 before 22.3R3-S5, and from 22.4 before 22.4R3-S9.
- CVE-2026-102178Critical
A stack-based buffer overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.
- CVE-2026-102175Critical
A heap-based buffer overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.
- CVE-2026-102031Critical
An OS command injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.
Original NVD description (English source)
The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view and modify shipment options — including carrier, delivery type, package type, number of labels, weight, signature requirement, and insurance — on any arbitrary order.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS