CVE-2026-81790 Overview
CVE-2026-81790 is a missing authorization vulnerability in the Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez plugin for WordPress. The plugin provides Hungarian pickup points and shipping label functionality for WooCommerce stores. All versions before 4.2.8 are affected. The flaw is classified under CWE-862: Missing Authorization and allows unauthenticated network attackers to exploit incorrectly configured access control on plugin endpoints. Successful exploitation impacts data integrity without requiring user interaction or privileges.
Critical Impact
An unauthenticated remote attacker can invoke protected plugin functionality and modify data belonging to the WooCommerce store, including shipping-related records handled by the plugin.
Affected Products
- Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez (Hungarian Pickup Points for WooCommerce) — all versions before 4.2.8
- WordPress installations running the plugin with WooCommerce enabled
- Sites exposing plugin AJAX or REST endpoints to unauthenticated visitors
Discovery Timeline
- 2026-09-08 - CVE-2026-81790 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-81790
Vulnerability Analysis
The plugin exposes functionality that changes state or returns protected data without verifying the caller's authorization. Because the endpoints are reachable over the network without authentication or user interaction, an attacker only needs to send crafted HTTP requests to the vulnerable WordPress instance. The flaw impacts integrity: the attacker can invoke administrative or privileged plugin actions that should be restricted to authenticated store operators.
Confidentiality and availability are not directly affected according to the CVSS vector, but integrity impact is high because tampered shipping data, pickup point configurations, or label records can disrupt order fulfillment and customer deliveries. The vulnerability is corrected in plugin version 4.2.8.
Root Cause
The root cause is CWE-862: Missing Authorization. One or more plugin request handlers omit a capability check such as current_user_can() and do not validate a nonce with check_ajax_referer() or wp_verify_nonce(). As a result, the server processes requests from any origin regardless of the caller's role.
Attack Vector
Exploitation is performed remotely over HTTP or HTTPS by sending a request directly to the affected endpoint, typically under wp-admin/admin-ajax.php or a plugin REST route. No credentials, no user session, and no social engineering are required. The vulnerability manifests when the request handler executes privileged logic without evaluating the caller's identity or capabilities. Refer to the Patchstack advisory for endpoint-level details.
Detection Methods for CVE-2026-81790
Indicators of Compromise
- Unauthenticated POST or GET requests to admin-ajax.php referencing plugin actions from the Hungarian pickup points plugin.
- Unexpected changes to WooCommerce shipping data, pickup point configuration, or plugin option rows in wp_options.
- Requests to plugin REST routes originating from IPs that never previously authenticated to wp-login.php.
Detection Strategies
- Inspect web server access logs for repeated calls to plugin AJAX actions without an accompanying wordpress_logged_in_* cookie.
- Enable WordPress audit logging to record option updates and administrative actions performed by unauthenticated or anonymous sessions.
- Compare plugin version against 4.2.8 across managed WordPress fleets using a software inventory query.
Monitoring Recommendations
- Alert on HTTP 200 responses to admin-ajax.php with plugin action parameters from anonymous clients.
- Monitor database write patterns on WooCommerce shipping tables outside of normal admin working hours.
- Forward WordPress and web server logs to a centralized analytics platform to correlate anomalous request bursts with configuration drift.
How to Mitigate CVE-2026-81790
Immediate Actions Required
- Upgrade the Csomagpontok és szállítási címkék WooCommerce-hez plugin to version 4.2.8 or later on every WordPress site.
- Audit WooCommerce shipping configuration and pickup point records for unauthorized modifications since the plugin was installed.
- Rotate WordPress administrator credentials and API keys if evidence of tampering is found.
Patch Information
The vendor addressed the flaw in plugin version 4.2.8. Update through the WordPress plugin manager or by deploying the updated release from the plugin repository. Details are documented in the Patchstack vulnerability entry.
Workarounds
- Block unauthenticated access to plugin AJAX actions and REST routes at the web application firewall until the update is deployed.
- Restrict wp-admin/admin-ajax.php requests originating outside trusted IP ranges when store administration is limited to known operators.
- Temporarily deactivate the plugin if immediate patching is not feasible and shipping label workflows can be paused.
# Configuration example: WP-CLI update and verification
wp plugin update hungarian-pickup-points-for-woocommerce --version=4.2.8
wp plugin get hungarian-pickup-points-for-woocommerce --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.