Weight Based Shipping for WooCommerce

Weight Based Shipping for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 5.4 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Weight Based Shipping for WooCommerce has a vendor fix available, so running the current release closes it.

All of these findings were reported by Muhammad Daffa. Weight Based Shipping for WooCommerce is installed on roughly 50,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Weight Based Shipping for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2022-46794

WooCommerce Weight Based Shipping <= 5.4.1 - Cross-Site Request Forgery leading to Plugin Settings Changes

Read the full analysis

Vulnerability Records

1 records
Weight Based Shipping for WooCommerce banner
Latestv6.20.0

Weight Based Shipping for WooCommerce

Dan (weight based shipping)

Author

Dan (weight based shipping)

4.6(83)
92/100
Last Updated
2026-10-16 (12d ago)
Active Installs
50,000+
Downloads
2,883,080
Requires WP
5.8+
Requires PHP
7.3+
Tested up to
WP 7.1.3
Created
2013-07-25 (13y ago)

Weight Based Shipping brings shipping by weight to WooCommerce. Your price list becomes a table of rules — weight brackets, a price per pound or kilogram, free shipping over an amount, a different rate per country — and the plugin calculates the shipping cost your customer sees at checkout from that table. The plugin has been in the directory since 2013 and runs on more than 50,000 stores. There is no carrier account to open and no rate service to connect: prices come from your own table and are calculated inside your store.   Weight brackets A price for every weight range, the way carrier price lists are written and what table rate shipping usually means: up to 2 kg $5.00, 2 to 5 kg $8.00, over 5 kg $12.00. Weights come from your products, in kilograms, grams, pounds, or ounces — whichever unit your store uses.   Shipping per lb or per kg Charge by weight itself rather than by range: $1.50 for every 0.5 kg, or a straight price per kilogram or per pound. Add a base amount and you get the familiar “$3.75 for the first 5 kg, plus $0.75 for every kilogram over it”.   Free shipping over an amount Free delivery once the cart reaches your threshold, normal rates below it. The threshold can be an order amount or a weight — free shipping up to 10 kg, paid above.   Rates by order total Price shipping by the cart total as well as by weight: $6.00 under $50, $3.00 from $50 to $100, free from $100. Weight and order total also combine in one rule, so free shipping over $100 can stop at 10 kg and let heavier orders pay their way.   Flat rates, handling fees, and surcharges Not every line of a price list depends on weight. A rule can add a fixed amount — a flat national rate, a handling fee, a surcharge on oversized orders — and applies only to the orders it is meant for.   Shipping rates by country Different shipping rates for different countries in one table: a domestic rate, a rate for neighbouring countries, and a rest-of-the-world rate. For finer geography, down to postcodes, the method slots into WooCommerce shipping zones.   Quantity based shipping For products of a uniform weight, weight stands in for quantity: $4.00 for every 0.5 kg is $4.00 per 0.5 kg item. The quantity based shipping recipe extends that to bulk pricing.   Several shipping options at checkout Standard and Express, or delivery alongside pickup: add the method to a zone as many times as you have options, each with its own name, its own rules, and its own price.   Rule priority Rules that both apply add up — a handling fee on top of a per-class rate, as a mixed cart should be priced. Rules meant as alternatives get conditions that cannot both hold, such as 0–2 kg and 2–5 kg, and only one of them applies. For everything beyond that, the Pro edition adds mods: — Stop ends the evaluation at its rule: the first match wins, and a rule placed higher overrides everything below it. — Drop takes the items a rule has already priced out of the calculation, so nothing is charged twice. — Deny withholds the method from orders it must not carry — a weight your carrier does not accept. — Require shows the method only for orders that match — a refrigerated option only when something frozen is in the cart. Mods has the details.   Rates by shipping class [Pro] Pro rules can target a shipping class, so each kind of product is priced its own way: a flat price for T-shirts, a per-kilogram rate for bulky goods, a surcharge on anything fragile. The same targeting decides free shipping product by product — items that never ship free, items that do not count toward the threshold, or one product that makes the whole order free.   Split shipping [Pro] Pro keeps several tables inside one shipping method. When two of them each cover part of the cart — a frozen courier and an ordinary parcel — the customer sees one combined option, priced as the sum of both parts. Multiple shipping options covers both arrangements.   Copy rules from staging to production [Pro] Build and test the price list on a staging or local site, then move it to the live store without retyping a number: copy a table, or just the rules you pick, and paste it on the other site. The transfer goes through the ordinary clipboard, so there is no file to export and upload. Copy and paste shows it step by step. Pro also brings undo and redo, value thresholds converted by an active currency switcher, and direct email support. Compare the editions.     Documentation Getting started builds a first price list, how rules work explains matching and combining, and troubleshooting covers a checkout that reports no shipping options. Recipes are worked setups: shipping by weight, shipping per lb, free shipping over an amount, rates by country, and rates by shipping class.   Install the plugin, open the starter table, and replace the numbers with your own. If anything does not add up, ask in the support forum. Like the plugin? Leave a review!

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C