Subscriber Sensitive Data Exposure in ShipTime Shipping Plugin

CVE-2026-59528 represents a critical data exposure vulnerability affecting ShipTime versions 1.1.1 and earlier, where subscriber sensitive information—including personal details tied to discounted shipping rates—is inadequately protected. This vulnerability matters because e-commerce platforms and their customers face direct risk of identity theft, fraud, and privacy violations when shipping subscriber data is exposed. Organizations using ShipTime for discounted shipping logistics are affected, along with their end-customers whose personal information may be accessed by unauthorized threat actors.

While this CVE currently maps to zero Casky skills due to the lack of MITRE ATT&CK technique alignment, practitioners using Casky's extended reasoning capabilities would detect the underlying attack patterns by analyzing information exposure indicators: unauthorized access logs showing data retrieval from shipping endpoints, unusual query patterns against subscriber databases, and exfiltration attempts targeting PII fields. Claude's reasoning would identify this as belonging to reconnaissance and collection phases (ATT&CK Techniques T1592, T1005, T1213) even without direct CVE mapping, flagging suspicious authentication patterns, data access anomalies, and lateral movement attempts targeting shipping service integrations. Practitioners would observe these detection gaps and should implement compensating controls around API authentication, data classification, and monitoring subscriber data access patterns until Casky skills are expanded for this vulnerability class.