CVE-2026-9858

Overview

The Partial Shipment for WooCommerce plugin for WordPress up to version 3.4 suffers from a missing authorization vulnerability in multiple AJAX handlers. The affected endpoints lack proper capability checks, nonce verification, and order ownership validation. This allows authenticated users with low privileges, such as subscribers, to access sensitive order item details and modify shipment statuses for arbitrary customer orders.

Description

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action.

Impact

This vulnerability impacts the confidentiality and integrity of e-commerce operations by exposing customer order details and permitting unauthorized modifications to shipment records. Low-privileged authenticated users can manipulate order shipment statuses and potentially trigger unintended order status transitions. Site administrators and customers are directly affected through potential data exposure and inventory or fulfillment tampering.

Remediation

Update the Partial Shipment for WooCommerce plugin to the latest patched version once available. Ensure that appropriate capability checks, nonce verification, and user-to-order ownership validations are implemented if modifying the source code temporarily. Restrict untrusted user registrations and monitor subscriber-level accounts for suspicious AJAX requests directed at the plugin.

Risk context

The vulnerability carries a medium severity CVSS v3 score of 4.3, indicating a moderate technical risk. The low EPSS value of 0.00215 suggests that active exploitation in the wild is currently limited. However, remediation is recommended to prevent unauthorized order manipulation and data access on e-commerce platforms.

Affected products

• WooCommerce Partial Shipment plugin for WordPress <= 3.4