CVE-2026-87846
Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.
| Vendor | unknown |
| Product | shipping for nova poshta |
| Published | Oct 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown shipping for nova poshta
Be the first to know when new medium vulnerabilities affecting unknown shipping for nova poshta are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Shipping for Nova Poshta
1.18.7 ≤ 1.19.8
References
Credits
Emiliano Carrizo WPScan