CVE-2026-103378: Geliver WordPress Plugin Exposure Flaw

CVE-2026-103378 Overview

CVE-2026-103378 affects the Geliver Akıllı Kargo Pazaryeri WordPress plugin in versions before 3.1.1. The plugin writes a log file to a web-accessible directory without authentication controls. This log file contains the site's carrier integration key and customer order information. Unauthenticated attackers can retrieve the key over the network and use it to modify WooCommerce order statuses. The same log also exposes personally identifiable information from processed orders. The weakness maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve carrier integration keys and customer order data, then abuse the key to tamper with WooCommerce order statuses.

Affected Products

Geliver Akıllı Kargo Pazaryeri WordPress plugin versions prior to 3.1.1
WordPress sites running WooCommerce with the vulnerable plugin installed
E-commerce deployments using Geliver carrier integration for shipping

Discovery Timeline

2026-10-07 - CVE-2026-103378 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-103378

Vulnerability Analysis

The Geliver Akıllı Kargo Pazaryeri plugin stores a log file inside its own plugin directory under the WordPress wp-content/plugins/ tree. This directory is served directly by the web server. The log file receives entries whenever the plugin processes requests from unauthenticated users. During that processing, the plugin writes the carrier integration key into the log alongside order metadata belonging to shop customers.

Because the file resides in a web-accessible path and no access controls restrict retrieval, any remote actor can request the log over HTTP. Reading the log yields the integration key used to authenticate against the Geliver carrier API. The attacker can then issue authenticated carrier requests that update WooCommerce order statuses on the affected store.

Root Cause

The root cause is a combination of two design flaws classified under CWE-200. First, the plugin writes a sensitive secret, the carrier integration key, into a log file as part of normal request handling. Second, the plugin stores that log in a directory served by the web server without an .htaccess deny rule, an index.php guard, or placement outside the document root. The combination exposes both credentials and customer data to unauthenticated retrieval.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker enumerates the plugin's web-accessible directory, requests the log file by its known path, and parses the file to extract the carrier integration key and customer order details. The attacker then calls the carrier API with the stolen key to change WooCommerce order statuses, enabling fraud scenarios such as marking unpaid orders as shipped or cancelling legitimate deliveries. Customer PII from the log can be used for phishing or resale.

Detection Methods for CVE-2026-103378

Indicators of Compromise

HTTP GET requests from external IP addresses targeting files under wp-content/plugins/ paths associated with the Geliver plugin
Access log entries referencing .log or similarly named files inside the plugin's directory
Unexpected WooCommerce order status changes without a corresponding admin session or legitimate carrier callback
Outbound API calls to Geliver endpoints originating from unknown source addresses using the site's integration key

Detection Strategies

Review web server access logs for requests to plugin-owned log files and flag responses with 200 status codes
Correlate WooCommerce order status transitions with the authenticated user or API source that initiated the change
Alert on repeated directory enumeration against wp-content/plugins/ paths, which often precedes targeted file retrieval

Monitoring Recommendations

Enable WordPress audit logging for order lifecycle events and plugin file access
Forward web server and WordPress logs to a centralized SIEM for retention and correlation
Monitor file integrity on the plugin directory to detect new or growing log files that may contain secrets

How to Mitigate CVE-2026-103378

Immediate Actions Required

Upgrade the Geliver Akıllı Kargo Pazaryeri plugin to version 3.1.1 or later on all affected WordPress sites
Rotate the Geliver carrier integration key immediately after upgrading, assuming the previous key is compromised
Delete existing log files from the plugin directory to remove exposed keys and customer data
Review WooCommerce order history for unauthorized status changes and notify affected customers if PII was exposed

Patch Information

The vendor addressed CVE-2026-103378 in Geliver Akıllı Kargo Pazaryeri version 3.1.1. Administrators should apply the update through the WordPress plugin manager or by replacing the plugin files manually. Refer to the WPScan Vulnerability Report for additional advisory detail.

Workarounds

Block direct HTTP access to the plugin's log file by adding a web server deny rule for .log files under wp-content/plugins/
Place a restrictive .htaccess file in the plugin directory to deny all direct file requests until the patch is applied
Temporarily disable the plugin if the patch cannot be applied and the site faces active enumeration attempts

bash

# Apache: deny direct access to .log files inside the plugin directory
<FilesMatch "\.log$">
    Require all denied
</FilesMatch>

# Nginx: equivalent location block
location ~* /wp-content/plugins/.*\.log$ {
    deny all;
    return 403;
}