Flexible Shipping 6.13.4 unauthorised shipping manifest disclosure

BugShield Scout discovered missing authorisation and ineffective nonce validation in the shipping manifest download handler bundled with Flexible Shipping 6.13.4. A low-privilege logged-in user, including a subscriber who can access wp-admin, can request an existing shipping manifest by its ID without permission to manage WooCommerce. Manifest files may contain customer and shipment information. Exploitation requires an existing manifest and a request that reaches the registered admin_init handler; the presence of the plugin alone does not establish that a site has manifest data to disclose. In vendor_prefixed/wpdesk/wp-wpdesk-fs-shipment/src/WPDesk/FS/Shipment/Manifest/CustomPostType.php, download_manifest() prints an error for an invalid non-empty nonce but continues to load and return the requested manifest. It does not check a user capability before reading or sending the file. The stored filename is also placed directly in the Content-Disposition header. BugShield privately supplied the technical report to Octolize on 20 October 2026, and Octolize subsequently confirmed that its developers had patched the issue. Comparison of the published 6.13.4 and 6.13.5 packages confirms that 6.13.5 requires manage_woocommerce and rejects missing or invalid nonces before loading a manifest. It also sanitises and quotes the download filename. The same release adds a capability check to manifest cancellation and restricts the manifest post type to WooCommerce management capabilities. The official changelog dates version 6.13.5 to 20 October 2026 and describes authorisation and nonce fixes for manifest downloads and cancellations. BugShield reviewed the affected and fixed source packages but has not performed an independent functional retest in WordPress. The confirmed affected version is 6.13.4; earlier versions and other products bundling this library were not assessed for this advisory. Medium is BugShield's qualitative severity assessment; no CVE or numerical CVSS score is assigned.

Discovered by BugShield Scout. Published by BugShield.