{
 "id": "WPSEC-2026-1972",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1972/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1972/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1972/index.md",
 "title": "Melhor Envio <= 3.0.7 - Unauthenticated Improper Certificate Validation via Disabled SSL Verification",
 "description": "The Melhor Envio plugin for WordPress is vulnerable to Improper Certificate Validation in versions 3.0.6 up to, and including, 3.0.7 due to the plugin turning off TLS certificate verification for every outgoing HTTPS request on the site through the 'https_ssl_verify' and 'https_local_ssl_verify' filters, and sending its own Melhor Envio API requests with 'sslverify' set to false. This makes it possible for unauthenticated attackers in a privileged network position to intercept or tamper with the site's remote HTTPS requests, including the plugin's authenticated API traffic.",
 "plugin": {
  "slug": "melhor-envio-cotacao",
  "name": "Melhor Envio",
  "full_name": "Melhor Envio",
  "wordpress_org": "https://wordpress.org/plugins/melhor-envio-cotacao/",
  "advisories_url": "https://wpsec.com/vuln/plugin/melhor-envio-cotacao/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/melhor-envio-cotacao"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-295"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.6",
    "from_inclusive": true,
    "to": "3.0.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.6 before 3.0.8"
  ]
 },
 "introduced_in": "3.0.6",
 "fixed_in": "3.0.8",
 "remediation": "Update to 3.0.8 or later.",
 "fix_released": "2026-10-28T19:41:03+00:00",
 "published": "2026-10-29T19:43:39+00:00",
 "updated": "2026-10-29T17:42:53.956169+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1972/",
  "https://plugins.svn.wordpress.org/melhor-envio-cotacao/tags/3.0.8/",
  "https://wordpress.org/plugins/melhor-envio-cotacao/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/melhor-envio-cotacao",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}