# Melhor Envio <= 3.0.7 - Unauthenticated Improper Certificate Validation via Disabled SSL Verification

- **ID:** WPSEC-2026-1972
- **Plugin:** Melhor Envio (`melhor-envio-cotacao`), https://wordpress.org/plugins/melhor-envio-cotacao/
- **Affected versions:** from 3.0.6 before 3.0.8
- **Fixed in:** 3.0.8 (Update to 3.0.8 or later.)
- **Severity:** High 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **Weakness:** CWE-295
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/melhor-envio-cotacao
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1972/

## Description

The Melhor Envio plugin for WordPress is vulnerable to Improper Certificate Validation in versions 3.0.6 up to, and including, 3.0.7 due to the plugin turning off TLS certificate verification for every outgoing HTTPS request on the site through the 'https_ssl_verify' and 'https_local_ssl_verify' filters, and sending its own Melhor Envio API requests with 'sslverify' set to false. This makes it possible for unauthenticated attackers in a privileged network position to intercept or tamper with the site's remote HTTPS requests, including the plugin's authenticated API traffic.

## References

- https://wpsec.com/vuln/WPSEC-2026-1972/
- https://plugins.svn.wordpress.org/melhor-envio-cotacao/tags/3.0.8/
- https://wordpress.org/plugins/melhor-envio-cotacao/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1972/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.