CVE-2026-103378 in Geliver Akıllı Kargo Pazaryeri Plugin
Summary
by MITRE • 10/07/2026
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Geliver Akıllı Kargo Pazaryeri WordPress plugin versions prior to 3.1.1 represents a critical failure in access control and sensitive data handling, specifically categorized under CWE-200 as an Information Exposure Vulnerability. The core technical flaw stems from the improper configuration of file permissions and directory restrictions for log files generated by the plugin. Instead of storing these logs in a non-web-accessible location outside the public document root or implementing strict authentication checks on read operations, the application writes sensitive operational data directly into a web-accessible directory within its own installation path. This architectural oversight allows any unauthenticated user with network access to the WordPress site to issue HTTP GET requests and retrieve the contents of these log files without requiring valid credentials or session tokens.
The specific content exposed by this vulnerability includes the carrier integration key, which is written into the log file during the processing of requests from unauthenticated users. This API credential serves as a critical authentication token for communicating with external shipping carriers to manage logistics and order fulfillment processes within WooCommerce. By extracting this key, an attacker gains the ability to impersonate the legitimate e-commerce store in interactions with third-party carrier services. Furthermore, the log files also contain detailed customer information from processed orders, including potentially personally identifiable information such as names, addresses, and contact details, leading to a severe breach of privacy regulations like GDPR or CCPA depending on the jurisdiction.
The operational impact of this vulnerability is significant due to the potential for both data exfiltration and service manipulation. Once an attacker obtains the carrier integration key, they can exploit CWE-287 Improper Authentication by using it to modify WooCommerce order statuses through legitimate API endpoints provided by shipping carriers. This capability allows malicious actors to change delivery states from pending or processing to delivered without actual shipment occurring, which can facilitate fraud schemes such as false refund claims or inventory manipulation. Additionally, the exposure of customer data constitutes a direct compromise of confidentiality and integrity, potentially leading to identity theft, phishing attacks targeting customers with their specific order details, and substantial reputational damage for the online store owner.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. The primary remediation is to upgrade the Geliver Akállı Kargo Pazaryeri plugin to version 3.1.1 or later, where this access control issue has been resolved by restricting log file accessibility or moving logs outside the web root. For sites unable to update immediately due to compatibility constraints, administrators should manually restrict HTTP GET requests for specific log files using server-level configurations such as Apache mod_rewrite rules or Nginx deny directives to block external access while allowing internal application processes to write and read them securely. It is also imperative to rotate the compromised carrier integration key immediately upon discovery of a breach to invalidate any stolen credentials.
From an offensive security perspective, this vulnerability aligns with ATT&CK technique T1078 Valid Accounts if the attacker leverages other means to gain initial access, but more accurately reflects T1539 Steal Web Session Cookie or T1552 Unsecured Credentials when considering the extraction of API keys. The exploitation path involves passive reconnaissance followed by direct data retrieval via HTTP requests, falling under the Initial Access and Collection tactics in the MITRE ATT&CK framework for web applications. Security teams should implement regular vulnerability scanning focused on file permission misconfigurations and ensure that all plugins adhere to secure coding standards that prevent sensitive information from being logged in publicly accessible locations. Continuous monitoring of log files for unusual access patterns can also aid in early detection of such exploitation attempts before significant damage occurs.