Missing authorization in the AfterShip Tracking plugin allows unauthorized users to invoke functions that should be restricted, potentially exposing confidential shipping information and permitting manipulation of tracking entries. This flaw enables attackers to read or modify data intended for legitimate staff, thereby compromising confidentiality and integrity. The vulnerability is a broken access control, classified as CWE‑862, and can affect any user who can reach the plugin’s endpoints without the proper role checks.

WordPress sites that employ the AfterShip Tracking plugin, from the earliest release through version 1.17.17. The plugin is distributed by AfterShip and Automizely. Any instance of the plugin within this version range is susceptible unless additional access restrictions have been applied manually.

The CVSS base score of 5.3 indicates moderate impact. The EPSS score of less than 1% suggests a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is sending crafted HTTP requests to exposed plugin endpoints by an attacker with network access, without requiring advanced skills. Consequently, the overall risk is moderate, particularly for installations that expose the plugin to external users or handle sensitive logistics data.