CVE WATCH / VULNERABILITY DETAIL
CVE-2026-127207
MEDIUMCVSS 5.4NVD feed
Published 12 November 2026 · tracked since 13 November 2026
Description
Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller.
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-107412
- CVE-2026-107411
- CVE-2026-16662 LOW 2.4
- CVE-2026-127928 LOW 2
- CVE-2026-127284 HIGH 7.3
- CVE-2026-127283 HIGH 7.3
- CVE-2026-127282 MEDIUM 4.3
- CVE-2026-107410
- CVE-2026-107409
- CVE-2026-107408