CVE-2025-62976: Sendle Shipping Auth Bypass Vulnerability

CVE-2025-62976 Overview

CVE-2025-62976 is a missing authorization vulnerability affecting the Joovii Sendle Shipping plugin for WordPress (official-sendle-shipping-method). The flaw allows unauthenticated attackers to access plugin functionality that is not properly constrained by Access Control Lists (ACLs). The issue impacts all versions of Sendle Shipping up to and including 6.02. The weakness is categorized under CWE-862: Missing Authorization.

Critical Impact
Remote attackers can invoke restricted plugin functionality without authentication, potentially degrading the availability of WooCommerce shipping operations on affected WordPress sites.

Affected Products

Joovii Sendle Shipping plugin for WordPress (official-sendle-shipping-method)
All versions up to and including 6.02
WooCommerce stores integrating Sendle shipping through this plugin

Discovery Timeline

2025-10-27 - CVE-2025-62976 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62976

Vulnerability Analysis

The vulnerability stems from a broken access control condition in the Sendle Shipping WordPress plugin. One or more plugin endpoints fail to verify the caller's role or capability before executing privileged logic. As a result, functionality intended for authenticated administrators or shop managers becomes reachable by unauthenticated network requests.

According to the Patchstack Vulnerability Report, the flaw impacts availability rather than confidentiality or integrity. Attackers exploiting this weakness can disrupt shipping-related operations without exposing customer data or modifying shop configuration in an authenticated manner. The EPSS score is 0.256% with a percentile of 16.973 as of 2026-07-14, indicating low observed exploitation likelihood.

Root Cause

The root cause is the absence of authorization checks on plugin action handlers. WordPress plugins typically enforce access control through current_user_can() capability checks and nonce validation via check_ajax_referer() or wp_verify_nonce(). In the affected releases of Sendle Shipping, one or more handlers register with WordPress hooks such as wp_ajax_nopriv_* or REST routes without a permission_callback, permitting unauthenticated invocation.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint. The request does not require valid credentials, a user session, or user interaction. Successful exploitation triggers restricted functionality that can affect the availability of the shipping subsystem.

No verified public proof-of-concept code is available. Refer to the Patchstack advisory for further technical detail.

Detection Methods for CVE-2025-62976

Indicators of Compromise

Unauthenticated HTTP POST or GET requests targeting /wp-admin/admin-ajax.php with action parameters tied to the Sendle Shipping plugin.
Unexpected requests to WordPress REST routes registered by official-sendle-shipping-method originating from unauthenticated sessions.
Anomalous changes in WooCommerce shipping method behavior or availability without corresponding administrator activity in audit logs.

Detection Strategies

Inspect web server access logs for requests to Sendle plugin endpoints from IPs that never authenticated to /wp-login.php.
Correlate WordPress audit log entries with plugin action invocations to identify calls occurring outside of authenticated administrator sessions.
Deploy WAF rules that flag anonymous access to plugin actions containing the sendle string in the action query parameter.

Monitoring Recommendations

Enable verbose logging on the WordPress instance and forward logs to a centralized platform for correlation.
Track the installed version of the Sendle Shipping plugin across all WordPress deployments using asset inventory tooling.
Alert on spikes in admin-ajax.php traffic that lack an authenticated session cookie.

How to Mitigate CVE-2025-62976

Immediate Actions Required

Identify all WordPress sites running the official-sendle-shipping-method plugin at version 6.02 or earlier.
Update the Sendle Shipping plugin to a fixed release once published by Joovii, tracked via the Patchstack advisory.
Restrict access to /wp-admin/admin-ajax.php and REST API endpoints at the WAF layer while a patched version is being validated.

Patch Information

As of the last NVD modification on 2026-06-17, the advisory indicates affected versions from n/a through <= 6.02. Administrators should consult the vendor's plugin repository listing on WordPress.org and the Patchstack database for the fixed version and upgrade guidance.

Workarounds

Temporarily deactivate the Sendle Shipping plugin if a patched release is not yet available and shipping integrations can tolerate downtime.
Apply a virtual patch through a Web Application Firewall to block unauthenticated requests to plugin-specific action parameters.
Enforce IP allowlisting on /wp-admin/ and administrative REST routes to reduce the exposed attack surface.

bash

# Example WAF/nginx rule to block unauthenticated Sendle plugin AJAX calls
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "sendle") {
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}