CVE-2025-26765: 
WordPress vulnerability analysis and mitigation

The Distance Based Shipping Calculator WordPress plugin versions 2.0.22 and below contains a Missing Authorization vulnerability (CVE-2025-26765). This security issue was discovered by researcher Kévin Mosbahi (Mika) and was publicly disclosed on February 14, 2025. The vulnerability affects the WordPress plugin's access control mechanisms (Patchstack).

The vulnerability is classified as a Broken Access Control issue with a CVSS v3.1 score of 5.4 (Low severity). The security flaw stems from missing authorization, authentication, or nonce token checks in certain functions, potentially allowing unprivileged users to execute higher privileged actions (Patchstack).

The vulnerability has been assessed to have a low severity impact and is considered unlikely to be exploited. It potentially allows subscriber-level users to perform unauthorized actions within the plugin's functionality (Patchstack).

The vulnerability has been fixed in version 2.0.23 of the Distance Based Shipping Calculator plugin. Users are advised to update to this version or later to remediate the security issue. The fix was released shortly after the vulnerability was reported (Patchstack).