CVE-2026-87846: Nova Poshta WordPress Plugin Auth Bypass

CVE-2026-87846 Overview

CVE-2026-87846 affects the Shipping for Nova Poshta WordPress plugin through version 1.19.8. The plugin exposes an AJAX action to unauthenticated users without authorization, nonce, or ownership checks. Attackers can delete shipment records for arbitrary WooCommerce orders. The flaw also allows attackers to force the store to issue carrier waybill-deletion requests using the merchant's stored Nova Poshta API credentials. The weakness is categorized as Missing Authorization [CWE-862].

Critical Impact

Unauthenticated remote attackers can delete arbitrary shipment records and trigger waybill deletions at the carrier using the store's own API credentials, disrupting order fulfillment.

Affected Products

• Shipping for Nova Poshta WordPress plugin, versions up to and including 1.19.8
• WordPress sites using WooCommerce with the affected plugin
• Merchants integrating Nova Poshta carrier services via the plugin

Discovery Timeline

• 2026-10-09 - CVE-2026-87846 published to the National Vulnerability Database
• 2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-87846

Vulnerability Analysis

The plugin registers an AJAX action handler accessible via both authenticated (wp_ajax_) and unauthenticated (wp_ajax_nopriv_) hooks. The handler accepts an order identifier and performs destructive operations without verifying that the caller is authorized to act on the target order.

Two distinct impacts follow from the missing check. First, the plugin deletes the local shipment metadata associated with the specified WooCommerce order. Second, it invokes the Nova Poshta API using the merchant's stored credentials to request waybill deletion at the carrier. The attacker never needs to supply valid credentials because the plugin acts on their behalf.

Root Cause

The root cause is a missing authorization control [CWE-862]. The AJAX endpoint omits three defensive checks that WordPress plugins typically implement: a capability check through current_user_can(), a nonce validation through check_ajax_referer(), and an ownership check tying the requesting user to the targeted order. The combination of these omissions converts a legitimate administrative function into an unauthenticated destructive action.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker crafts an HTTP POST request to /wp-admin/admin-ajax.php specifying the vulnerable action and an order ID. Order IDs in WooCommerce are sequential integers, allowing enumeration. The attacker can script the request to iterate across order identifiers and strip shipment records in bulk. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-87846

Indicators of Compromise

• Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing the plugin's shipment-deletion action
• Sequential order IDs appearing in admin-ajax request parameters from the same source IP
• Unexpected outbound API calls from the WordPress host to Nova Poshta endpoints
• WooCommerce orders missing shipment metadata without a corresponding admin audit entry

Detection Strategies

• Review web server access logs for admin-ajax.php requests originating from unauthenticated sessions targeting the plugin's action name
• Correlate shipment-record deletions with the user context recorded in WordPress logs; legitimate deletions should map to authenticated staff accounts
• Alert on bursts of admin-ajax requests enumerating sequential order_id parameter values

Monitoring Recommendations

• Enable WooCommerce order audit logging to capture shipment metadata changes with timestamps and user attribution
• Monitor outbound traffic to the Nova Poshta API for request volumes inconsistent with normal fulfillment activity
• Deploy a web application firewall rule blocking unauthenticated access to the plugin's AJAX action

How to Mitigate CVE-2026-87846

Immediate Actions Required

• Identify all WordPress sites running Shipping for Nova Poshta version 1.19.8 or earlier
• Restrict access to /wp-admin/admin-ajax.php for the vulnerable action at the WAF or reverse proxy until a patch is applied
• Rotate Nova Poshta API credentials stored in the plugin if abuse is suspected
• Review recent orders for missing or deleted shipment records and reconcile with carrier records

Patch Information

At the time of publication, no fixed version is documented in the NVD entry. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org page for an updated release that adds authorization, nonce, and ownership checks to the affected AJAX handler.

Workarounds

• Disable the Shipping for Nova Poshta plugin until a patched version is released if waybill management is not critical
• Add a WAF rule denying unauthenticated POST requests to admin-ajax.php where the action parameter matches the plugin's vulnerable handler
• Use server-level access controls to limit /wp-admin/admin-ajax.php to authenticated sessions where feasible

# Example nginx rule blocking unauthenticated access to the vulnerable AJAX action
# Replace <vulnerable_action_name> with the handler identified from the WPScan advisory
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "<vulnerable_action_name>") {
        if ($http_cookie !~ "wordpress_logged_in") {
            return 403;
        }
    }
}