The vulnerability is a missing authorization check within the eshipper eShipper Commerce WordPress plugin. Attackers can bypass normal role or capability restrictions, allowing them to view or modify sensitive shipment configuration data and alter shipping rules, thereby compromising the integrity of eCommerce operations. This issue is categorized as a broken access control flaw (CWE‑862).

Any site running the eShipper Commerce plugin from eshipper, in a version equal to or older than 2.16.12, is affected. Users should verify the plugin version and upgrade if necessary.

The EPSS score is below 1 %, indicating a low likelihood of exploitation in the wild. The CVSS score is 5.3, indicating a medium severity vulnerability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers likely exploit the flaw by sending HTTP requests to plugin‑controlled administrative endpoints that lack proper authorization checks, which may be reachable with minimal credentials or even without authentication depending on site configuration.