CVE-2026-87846— Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
Quick assessment
Affected
Unknown Shipping for Nova Poshta
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nova Poshta 运费 WordPress 插件（版本 1.19.8 及之前）存在授权漏洞。该插件的一个 AJAX 操作未对未认证用户执行任何授权、nonce 或所有权验证，导致任何人都可以删除任意订单的发货记录，并促使商店使用该商店自己存储的 API 凭证，向承运商发出这些订单的运单删除请求。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Shipping for Nova Poshta | 1.18.7≤ 1.19.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87846
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Shipping for Nova Poshta | 1.18.7 ~ 1.19.8 | - |
|
II. Public POCs for CVE-2026-87846
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87846
请登录查看更多情报信息。
Other References for CVE-2026-87846 (1)
-
https://wpscan.com/vulnerability/e1ba1fbc-f61f-446f-a312-d725364313a6/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-09 · 16 CVEs total
| CVE-2026-89235 | 6.8 MEDIUM | Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter |
| CVE-2026-86851 | 6.5 MEDIUM | Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & |
| CVE-2026-103329 | 5.3 MEDIUM | Super Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook Signatu |
| CVE-2026-84220 | 4.8 MEDIUM | Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection |
| CVE-2026-85348 | 4.3 MEDIUM | GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF |
| CVE-2026-84224 | 4.1 MEDIUM | Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL |
| CVE-2026-106095 | Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via upd | |
| CVE-2026-106097 | Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Creden | |
| CVE-2026-93548 | FooSales < 1.43.3 - Subscriber+ Privilege Escalation via User Impersonation | |
| CVE-2026-87841 | UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook | |
| CVE-2026-92990 | SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded T | |
| CVE-2026-88931 | Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update | |
| CVE-2026-86850 | SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deleti | |
| CVE-2025-15700 | AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import | |
| CVE-2026-92989 | SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-103329
Super Payments < 1.43.1 - Unauthenticated Payment Confirmati -
CVE-2026-86851
Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status C -
CVE-2026-85348
GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CS -
CVE-2026-89235
Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated -
CVE-2026-84224
Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
V. Comments for CVE-2026-87846
No comments yet