[ CVE-2026-87846 · Published 9 Oct 2026 ]
Vulnerability in Unknown Shipping for Nova Poshta
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.