CVE-2026-9858Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions
Updated under an hour ago ()
Does this affect you?
It affects wpexpertshub Partial Shipment for WooCommerce. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action.
- CVSS
- 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness (CWE)
- CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Wordfence
- NVD analysis
- Deferred
- Record last updated
- Sep 20, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
wpexpertshub Partial Shipment for WooCommerce wpexpertshub:partial_shipment_for_woocommerce (from the name) | through 3.4 | CNA record |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d9278c56-b963-4d9b-ae5a-45dab44c701f?source=cve
- https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L291
- https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L228
- https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L263
- https://plugins.trac.wordpress.org/browser/wc-partial-shipment/tags/3.4/woocommerce-partial-shipment.php#L60
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3561104%40wc-partial-shipment&new=3561104%40wc-partial-shipment
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.