Missing Authorization Vulnerability in eShipper Commerce by Patchstack

CVE-2026-39689

What is CVE-2026-39689?

The eShipper Commerce plugin has a missing authorization vulnerability that arises from incorrectly configured access control security levels. This flaw permits unauthorized users to exploit the permissions granted to legitimate users, potentially leading to unauthorized access to sensitive functionalities. Systems using eShipper Commerce versions up to and including 2.16.12 are particularly at risk. It's essential for administrators to review their configurations and apply the necessary updates to mitigate this vulnerability.

References