Shipping For Nova Poshta
Monthly
Unauthenticated attackers can permanently delete shipment records belonging to arbitrary orders on WordPress sites running the Shipping for Nova Poshta plugin through version 1.19.8, and can additionally cause the store to fire the carrier's waybill-deletion request using the store's own stored Nova Poshta API credentials. The vulnerable AJAX action is registered for unauthenticated users and performs no authorization, nonce, or ownership validation, so no login, user interaction, or non-default configuration is required - the only friction is that the attacker must supply a target order identifier, which may require enumeration. Publicly available exploit code exists (reported via WPScan); there is no confirmation of active exploitation (not in CISA KEV), and the practical exposure is bounded to stores that have this specific plugin installed and active.
Unauthenticated attackers can permanently delete shipment records belonging to arbitrary orders on WordPress sites running the Shipping for Nova Poshta plugin through version 1.19.8, and can additionally cause the store to fire the carrier's waybill-deletion request using the store's own stored Nova Poshta API credentials. The vulnerable AJAX action is registered for unauthenticated users and performs no authorization, nonce, or ownership validation, so no login, user interaction, or non-default configuration is required - the only friction is that the attacker must supply a target order identifier, which may require enumeration. Publicly available exploit code exists (reported via WPScan); there is no confirmation of active exploitation (not in CISA KEV), and the practical exposure is bounded to stores that have this specific plugin installed and active.