# Montonio for WooCommerce <= 10.5.0 - Authenticated (Contributor+) Missing Authorization to Order Pickup Point and Shipping Address Modification

- **ID:** WPSEC-2026-2704
- **Plugin:** Montonio for WooCommerce (`montonio-for-woocommerce`), https://wordpress.org/plugins/montonio-for-woocommerce/
- **Affected versions:** from 6.4.7 before 10.5.1
- **Fixed in:** 10.5.1 (Update to 10.5.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/montonio-for-woocommerce
- **Fix released:** 2026-11-06
- **Published:** 2026-11-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2704/

## Description

The Montonio for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the process_selected_pickup_point AJAX action in all versions up to, and including, 10.5.0, due to a missing capability check on the admin pickup point AJAX handlers. The only protection was a nonce that the plugin printed on every wp-admin page for any user. This makes it possible for authenticated attackers, with Contributor-level access and above, to change the Montonio pickup point and the shipping address of any order by its ID.

## References

- https://wpsec.com/vuln/WPSEC-2026-2704/
- https://plugins.svn.wordpress.org/montonio-for-woocommerce/tags/10.5.1/
- https://wordpress.org/plugins/montonio-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2704/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.