Missing Authorization Vulnerability in R+L Carriers Edition Plugin for WordPress

CVE-2026-3646

What is CVE-2026-3646?

The R+L Carriers Edition plugin for WordPress is susceptible to a missing authorization issue within its webhook handler. This flaw primarily stems from inadequate authentication controls and nonce verification on a specific PHP file, which directly handles GET parameters and modifies WordPress options. As a result, unauthenticated attackers can alter critical plugin settings, such as downgrading active subscription plans, changing store types, and adjusting subscription expiration dates. This vulnerability poses a significant risk to users, potentially leading to the loss of premium features including Dropship and Hazardous Material handling.

References