Ship To eCourier
Ship To eCourier has one disclosed vulnerability in the WordSec catalog, all reported in 2021; it is fixed as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Ship To eCourier has a vendor fix available, so running the current release closes it.
All of these findings were reported by WPScanTeam. Ship To eCourier is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.0.
Ship To eCourier <= 1.0.1 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Ship To eCourier
Author
Simon Gomes
Ship To eCourier WordPress plugin gives you the ability to simply book your eCourier parcel request directly from your WooCommerce order dashboard. You can use WooCommerce order information and automate your eCourier parcel booking only with some button click. You will only need to provide the eCourier API credentials for your account. Other than the shipment and booking automation, the plugin will also provide you a shortcode that you can use for the parcel status tracking. You can add the shortcode to any of your pages and it will give your customer a neat interface for parcel tracking. Features The plugin provides following features. eCourier parcel booking automation eCourier parcel tracking Privacy Policy Ship To Ecourier uses Appsero SDK to collect some telemetry data upon user’s confirmation. This helps us to troubleshoot problems faster & make product improvements. Appsero SDK does not gather any data by default. The SDK only starts gathering basic telemetry data when a user allows it via the admin notice. We collect the data to ensure a great user experience for all our users. Integrating Appsero SDK DOES NOT IMMEDIATELY start gathering data, without confirmation from users in any case. Learn more about how Appsero collects and uses this data.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C