Nova Poshta Shipping CVE-2026-87846

No special configuration is required beyond having the Shipping for Nova Poshta plugin (version 1.19.8 or earlier) installed and active with its Nova Poshta API credentials stored, which is the normal operating state - the vulnerable AJAX action is explicitly exposed to unauthenticated (nopriv) users with no authorization, nonce, or ownership validation. The main practical limiter is that the attacker must reference target order identifiers to affect specific orders (arbitrary/other orders are reachable, but may require ID enumeration or guessing); there is no authentication, user-interaction, or non-default-setting barrier. Exploitation is confined to stores running this specific plugin, which bounds real-world exposure.

This is a genuine but moderate-severity broken-access-control flaw, not a high-urgency emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) is internally consistent with the description: a remote, unauthenticated attacker can reach a vulnerable AJAX action over the network with low complexity and no user interaction, producing a limited integrity impact (destruction of shipment records and triggering waybill-deletion). A public exploit exists (WPScan), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score was supplied, so there is no evidence of active, widespread exploitation - exploit availability and active exploitation are distinct signals and only the former is present here. No SSVC decision data was provided. The impact is bounded: C:N means no data is exposed, and A:N means the carrier/site stays up; the harm is tampering with/deleting order shipment data and causing unwanted carrier-side waybill deletions using the store's stored API credentials. Net: a real priority for stores actually running this plugin (unauthenticated + public PoC), but the limited integrity-only impact and regional niche footprint keep it below critical-patch-now status. One flag: the 'Information Disclosure' tag conflicts with the CVSS vector (C:N) and the description, which describe data destruction/tampering, not disclosure - treat the tag as mislabeled.

An unauthenticated attacker sends a crafted AJAX request (wp-admin/admin-ajax.php) to the plugin's unprotected nopriv action, specifying order identifiers they do not own. Because no authorization, nonce, or ownership check is performed, the store deletes those orders' shipment records and issues waybill-deletion requests to Nova Poshta using the store's own stored API credentials. A public proof-of-concept is available via WPScan, lowering the skill required to reproduce this.