CVE-2025-26960: Unishippers Edition Auth Bypass Flaw

CVE-2025-26960 Overview

CVE-2025-26960 is a missing authorization vulnerability in the enituretechnology Small Package Quotes – Unishippers Edition WordPress plugin. The flaw affects all plugin versions up to and including 2.4.9. The vulnerability stems from incorrectly configured access control security levels, allowing unauthenticated attackers to reach functionality that should be restricted. The issue is tracked under CWE-862: Missing Authorization.

Attackers can exploit this weakness over the network without user interaction or prior authentication. Successful exploitation results in limited impact to integrity and availability of the affected WordPress site.

Critical Impact
Unauthenticated network-based access to protected plugin functions enables tampering with shipping quote features and can disrupt normal e-commerce operations on WordPress sites running the vulnerable plugin.

Affected Products

Small Package Quotes – Unishippers Edition WordPress plugin versions up to and including 2.4.9
WordPress sites using the small-package-quotes-unishippers-edition plugin
E-commerce deployments integrating Unishippers shipping quotes via this plugin

Discovery Timeline

2025-02-25 - CVE-2025-26960 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26960

Vulnerability Analysis

The Small Package Quotes – Unishippers Edition plugin exposes functionality without adequately verifying the caller's authorization. The plugin registers actions or endpoints that lack proper capability checks. This allows requests from users who should not have access to invoke sensitive operations.

The attack surface is reachable over HTTP, requires no authentication, and requires no user interaction. Confidentiality is not affected, but attackers can influence limited integrity and availability characteristics of the plugin's shipping quote functions.

Refer to the Patchstack WordPress Vulnerability Advisory for advisory-specific technical details.

Root Cause

The root cause is [CWE-862] Missing Authorization. Plugin handlers fail to invoke WordPress capability checks such as current_user_can() or nonce validation via check_ajax_referer() before executing privileged actions. Without these guards, the plugin treats requests from any origin as authorized.

Attack Vector

An attacker sends crafted HTTP requests directly to the vulnerable plugin endpoints exposed by WordPress. Because privilege requirements are absent, the request bypasses the intended access boundary. The EPSS score is 0.373% at the 29.66 percentile, indicating a relatively low predicted exploitation probability at this time.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. Technical details describing the vulnerable code paths are available through the vendor advisory.

Detection Methods for CVE-2025-26960

Indicators of Compromise

Unexpected HTTP POST or GET requests to admin-ajax.php or REST endpoints referencing the small-package-quotes-unishippers-edition plugin from unauthenticated sessions
Anomalous invocation of plugin actions from IP addresses that have not authenticated to WordPress
Modifications to shipping quote configurations or logs without corresponding administrative sessions

Detection Strategies

Audit WordPress access logs for requests targeting plugin-specific action= parameters without valid authentication cookies
Deploy a Web Application Firewall (WAF) rule set that inspects requests to the plugin's endpoints and blocks unauthenticated calls
Enable WordPress plugin version inventory scanning to identify installations running versions <= 2.4.9

Monitoring Recommendations

Forward WordPress access.log and error.log entries to a centralized SIEM for correlation across sites
Alert on high-volume automated requests targeting wp-admin/admin-ajax.php referencing the affected plugin
Track plugin file integrity and configuration state to detect unauthorized modifications

How to Mitigate CVE-2025-26960

Immediate Actions Required

Identify all WordPress sites running the Small Package Quotes – Unishippers Edition plugin and confirm the installed version
Update the plugin to a version later than 2.4.9 once the vendor publishes a fix
Temporarily disable the plugin if a patched release is not yet available and the functionality is not required

Patch Information

At time of publication, users should consult the Patchstack WordPress Vulnerability Advisory for the latest guidance from the vendor and Patchstack. Apply the vendor-provided update as soon as it becomes available through the WordPress plugin repository.

Workarounds

Restrict access to wp-admin/admin-ajax.php and plugin REST routes using a WAF or reverse proxy rules until patched
Use a virtual patch through a Patchstack subscription or equivalent WordPress security service
Remove the plugin entirely if shipping quote functionality is not in active use

bash

# Example: identify vulnerable plugin installations via WP-CLI
wp plugin list --name=small-package-quotes-unishippers-edition --fields=name,status,version

# Deactivate the plugin as a temporary workaround
wp plugin deactivate small-package-quotes-unishippers-edition