Partial Shipment For Woocommerce
Monthly
Missing authorization in the Partial Shipment for WooCommerce plugin (versions up to and including 3.4) allows any authenticated WordPress user with Subscriber-level access to read order item details - product names, quantities and shipped counts - belonging to any customer, and to modify the shipment status and shipped quantities of arbitrary orders via the plugin's AJAX endpoints. The three affected handlers (wxp_order_shipment, wxp_order_item_shipment, wxp_order_set_shipped) perform no capability check, no nonce verification, and no validation that the caller owns the supplied order_id, and the related wxp_order_status action can additionally trigger order status transitions. This is a broken-access-control flaw, not an authentication bypass; no public exploit code has been identified at time of analysis, and there is no KEV or EPSS signal, but practical exposure is raised on stores that allow customer/subscriber self-registration during WooCommerce checkout.
Missing authorization in the Partial Shipment for WooCommerce plugin (versions up to and including 3.4) allows any authenticated WordPress user with Subscriber-level access to read order item details - product names, quantities and shipped counts - belonging to any customer, and to modify the shipment status and shipped quantities of arbitrary orders via the plugin's AJAX endpoints. The three affected handlers (wxp_order_shipment, wxp_order_item_shipment, wxp_order_set_shipped) perform no capability check, no nonce verification, and no validation that the caller owns the supplied order_id, and the related wxp_order_status action can additionally trigger order status transitions. This is a broken-access-control flaw, not an authentication bypass; no public exploit code has been identified at time of analysis, and there is no KEV or EPSS signal, but practical exposure is raised on stores that allow customer/subscriber self-registration during WooCommerce checkout.