Skip to content
Heist/ feed
Medium

Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion

Type: advisorySource: Official CVE List1 source record

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.

Announced Source revision 1
Original source ↗

CVE-2026-87846

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-87846

Shipping for Nova Poshta

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Unknown",
    "product": "Shipping for Nova Poshta",
    "versions": [
      {
        "status": "affected",
        "version": "1.18.7",
        "versionType": "semver",
        "lessThanOrEqual": "1.19.8"
      }
    ],
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unknown"
  }
]
Related CVEs
CVE-2026-87846

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#16284 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement