EUVD-2026-92747
GHSA-974j-c2pr-7977
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSend request to unprotected plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactModify shipping data/settings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account on the target WordPress site running the WC Ukraine Shipping (wc-ukr-shipping) plugin at version 1.23.2 or earlier (PR:L). Exploitation is limited by that authentication requirement: the attacker must hold a valid, if unprivileged, session - though on WooCommerce stores that permit open customer registration this barrier is frequently trivial to meet. No user interaction by a victim is needed (UI:N) and the attack is network-reachable (AV:N) against the plugin's affected endpoints; impact is limited to integrity (modification), with no confidentiality or availability effect per the provided vector. |
| Impact | This is a moderate-risk, not top-priority, vulnerability. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) indicates a remotely reachable, low-complexity flaw that nonetheless requires an authenticated low-privilege account (PR:L) and yields only an integrity impact - no confidentiality or availability loss. This aligns with the CWE-862 Missing Authorization classification and the Patchstack 'Broken Access Control' categorization: an authenticated user can perform actions beyond their authorization level. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no positive signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' The main caveat is the PR:L requirement combined with a WordPress plugin context: on many WooCommerce stores any customer can self-register a low-privilege account, which effectively lowers the barrier compared with the raw score. Overall this is a real but contained issue best handled on a routine patch cycle rather than as an emergency, absent any exploitation telemetry. |
| Exploit ScenarioDerived | An attacker registers or uses an existing low-privilege WordPress/WooCommerce account on a store running the WC Ukraine Shipping plugin (≤1.23.2) and sends a crafted request to a plugin endpoint that fails to verify the caller's authorization. Because the missing authorization check lets them invoke privileged plugin functionality, they modify shipping configuration or related data they should not be able to alter. No public exploit code was identified at the time of analysis, and no user interaction is required beyond the attacker's own authenticated session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Missing authorization in the WordPress plugin WC Ukraine Shipping (wc-ukr-shipping) through version 1.23.2 lets an authenticated low-privilege user invoke plugin functionality that performs no capability check, allowing unauthorized modification of shipping configuration and related store data. The attack is network-reachable and requires no victim interaction, but it does require a valid session on the target site (PR:L) - a modest barrier that is often trivial to clear on WooCommerce stores that allow open customer registration, and the assessed impact is integrity-only with no confidentiality or availability effect. This is a moderate-risk, not top-priority, vulnerability: no public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
RemediationAI
No vendor-released patch was identified in the available data at time of analysis, so the immediate priority is to check the plugin's update channel and Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wc-ukr-shipping/vulnerability/wordpress-wc-ukraine-shipping-plugin-1-23-2-broken-access-control-vulnerability?_s_id=cve) for a version above 1.23.2 and apply it as soon as it ships. Until a fixed release is confirmed, apply compensating controls: if the plugin is not actively in use, deactivate and remove it, which fully eliminates exposure at the cost of losing Ukrainian shipping integration; on stores where it is required, disable or tightly restrict open WooCommerce customer registration (and audit existing Subscriber-level accounts) so that the low-privilege session the exploit needs is hard to obtain, accepting the business trade-off of gated self-service signup; deploy a WAF or reverse-proxy rule that blocks requests to the plugin's AJAX/admin-post/REST routes originating from non-administrator sessions, recognizing that hand-tuned rules can break legitimate shipping operations and require testing; and review shipping settings, zone rates, and carrier configuration for tampering, since the flaw permits silent integrity modifications rather than data theft. Treat this as moderate priority alongside other patching work rather than an emergency, given the integrity-only impact and absence of known exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic WordPress access-control failure of the CWE-862 (Missing Authorization) class: one or more plugin entry points - typically admin-ajax.php actions, admin-post.php handlers, or REST routes - execute privileged operations without validating the caller's capabilities via current_user_can() or a nonce/capability check. Because WordPress routes these requests through the standard AJAX/REST plumbing, any logged-in user (including a Subscriber-level customer on a WooCommerce store) can reach the handler; the plugin simply fails to distinguish that user from a store administrator. The vulnerability affects the wc-ukr-shipping plugin maintained by Kirillbdev, an extension that integrates Ukrainian shipping carriers into WooCommerce checkout and order fulfillment, so the compromised functions relate to shipping method/settings state rather than core WordPress data. The CPE cpe:2.3:a:kirillbdev:wc_ukraine_shipping:*:*:*:*:*:*:*:* is version-wildcarded, and the vendor-supplied range in the advisory flags every release up to and including 1.23.2 as affected. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N confirms the exploit path is remote and low-complexity but gated on a low-privileged authenticated session, with the integrity of plugin/store state the sole impacted security property.
Know when Wc Ukraine Shipping gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable plugin endpoint (AV:N/AC:L) requiring any authenticated account (PR:L); missing authorization permits unauthorized modification (I:H) with no confidentiality or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB