CVE-2026-89289 — Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint

CVE-2026-89289

Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint PUBLISHED

Description (CNA)

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

Affected (CNA)

Vendor / product	Versions
Unknown / Fast Courier	affected 0 through 5.2.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/716b6d58-a816-43f2-8a1a-b9fe4f2f9d1d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.