Vulnerabilities / Melhor Envio / WPSEC-2026-1972
Melhor Envio <= 3.0.7 - Unauthenticated Improper Certificate Validation via Disabled SSL Verification
High 7.4
CWE-295Fixed in 3.0.8
- ID
- WPSEC-2026-1972
- Plugin
- Melhor Envio (melhor-envio-cotacao)
- Affected
- from 3.0.6 before 3.0.8
- Remediation
- Update to 3.0.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-295
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- Melhor Envio on WPSec AttackSurface
- Fix released
- Published
Description
The Melhor Envio plugin for WordPress is vulnerable to Improper Certificate Validation in versions 3.0.6 up to, and including, 3.0.7 due to the plugin turning off TLS certificate verification for every outgoing HTTPS request on the site through the 'https_ssl_verify' and 'https_local_ssl_verify' filters, and sending its own Melhor Envio API requests with 'sslverify' set to false. This makes it possible for unauthenticated attackers in a privileged network position to intercept or tamper with the site's remote HTTPS requests, including the plugin's authenticated API traffic.
References
- https://wpsec.com/vuln/WPSEC-2026-1972/
- https://plugins.svn.wordpress.org/melhor-envio-cotacao/tags/3.0.8/
- https://wordpress.org/plugins/melhor-envio-cotacao/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS