EUVD-2026-83570
GHSA-57j3-8vm6-c5m2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network AJAX endpoint (AV:N), no special preconditions (AC:L), needs a Subscriber account (PR:L), no interaction (UI:N); adds C:L for cross-customer order-detail disclosure the vendor omitted, I:L for shipment modification.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
4DescriptionCVE.org
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60-62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action.
AnalysisAI
Missing authorization in the Partial Shipment for WooCommerce plugin (versions up to and including 3.4) allows any authenticated WordPress user with Subscriber-level access to read order item details - product names, quantities and shipped counts - belonging to any customer, and to modify the shipment status and shipped quantities of arbitrary orders via the plugin's AJAX endpoints. The three affected handlers (wxp_order_shipment, wxp_order_item_shipment, wxp_order_set_shipped) perform no capability check, no nonce verification, and no validation that the caller owns the supplied order_id, and the related wxp_order_status action can additionally trigger order status transitions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account at Subscriber level or above on a WordPress site running Partial Shipment for Woocommerce <=3.4 with WooCommerce active and containing orders; exploitation targets the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions via admin-ajax.php. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-priority issue best characterized as a broken-access-control flaw, not the 'Authentication Bypass' its tag implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version has been independently confirmed; the only patch-adjacent artifact in the references is a WordPress.org plugin changeset (3561104) referenced by the CVE record, so treat this as an upstream fix available (commit/changeset) with the released patched version not independently confirmed, and check the plugin's WordPress.org page and changelog for the first version after 3.4 before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today