Vulnerability · Published Oct 7, 2026 · Assigned by WPScan

CVE-2026-103378Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

Medium 6.5

In plain English

A medium-severity information exposure in Geliver Akıllı Kargo Pazaryeri from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 92.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Geliver Akıllı Kargo Pazaryeri	3.0.0 – before 3.1.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/f95d8558-2225-416c-8968-752a40cdc17f/ exploit, vdb-entry, technical-description