The MyParcel WordPress plugin contains an authorization bypass vulnerability (CWE‑862) that allows any authenticated user with subscriber-level or higher access to read and modify order shipment options via the wcmp_get_shipment_options and wcmp_save_shipment_options AJAX actions. The lack of proper permission checks means an attacker can view or alter sensitive shipping data such as carrier, delivery type, package type, number of labels, weight, signature requirement, and insurance on any order, potentially changing shipping costs or delivery behavior without legitimate approval.

All installations of MyParcel version 4.25.1 and earlier, distributed by Richard Perdaan, are affected. The plugin integrates with WooCommerce on WordPress sites; any user who holds subscriber or higher roles on a site running one of these versions could exploit the flaw to manipulate shipment data for arbitrary orders.

With a CVSS score of 4.3 the vulnerability is considered medium severity, and an EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis. It is not listed in the CISA KEV catalog. The attack requires an authenticated session and can be performed remotely via the web interface by making AJAX requests to the vulnerable endpoints. Because the flaw does not allow elevation to higher privileges, the impact is confined to shipment data but could affect order fulfillment and cost integrity.