Unknown Fast Courier vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Fast Courier, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.6CVE-2026-89288unknownfast courier
EPSS score
0.34%
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.5.3CVE-2026-89289unknownfast courier+1
EPSS score
0.18%
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.