CVE-2026-9858: Partial Shipment for WooCommerce Auth Bypass

CVE-2026-9858 Overview

CVE-2026-9858 affects the Partial Shipment for WooCommerce plugin for WordPress in all versions up to and including 3.4. The plugin exposes three AJAX actions — wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped — without capability checks, nonce verification, or ownership validation on the supplied order_id. Authenticated attackers with Subscriber-level access can read arbitrary order item details from any customer and modify shipment status or shipped quantities on any order. Manipulating shipment state can also trigger order status transitions through the wxp_order_status action, corrupting fulfillment workflows across the store.

Critical Impact
Any authenticated Subscriber can enumerate customer order data and tamper with shipment records across the entire WooCommerce store.

Affected Products

Partial Shipment for WooCommerce plugin for WordPress
All versions up to and including 3.4
WooCommerce stores exposing subscriber registration or higher-privileged accounts

Discovery Timeline

2026-09-19 - CVE-2026-9858 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-9858

Vulnerability Analysis

The flaw is a Missing Authorization weakness [CWE-862] in the plugin's AJAX handlers registered in woocommerce-partial-shipment.php at lines 60–62. The handlers implemented at lines 228, 263, and 291 accept an order_id parameter from the request and act on the referenced WooCommerce order without confirming that the calling user owns the order or holds a shop-management capability. The handlers also skip WordPress nonce verification, removing the standard request-integrity control that WordPress plugins rely on for state-changing AJAX endpoints.

Because the endpoints are registered via wp_ajax_ hooks rather than wp_ajax_nopriv_, exploitation requires an authenticated session. However, the Subscriber role is the lowest privileged role in WordPress and is granted by default when open user registration is enabled on WooCommerce sites. This makes the vulnerability practical to exploit on any store that accepts customer sign-ups.

Root Cause

The root cause is the absence of three standard authorization controls in each AJAX handler: a current_user_can() capability check for shop-management privileges, a check_ajax_referer() nonce verification, and an ownership check comparing the supplied order_id against the authenticated user. Without these controls, WordPress treats the request as authorized as long as the user is logged in.

Attack Vector

An attacker registers or uses an existing Subscriber account, then sends POST requests to /wp-admin/admin-ajax.php with the action parameter set to wxp_order_shipment, wxp_order_item_shipment, or wxp_order_set_shipped and an arbitrary numeric order_id. Read requests return item names, quantities, and shipped counts for the targeted order. Write requests overwrite shipment status and shipped quantities, which can cascade into a wxp_order_status transition and alter customer-visible order state.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for authoritative technical details.

Detection Methods for CVE-2026-9858

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with the action parameter equal to wxp_order_shipment, wxp_order_item_shipment, or wxp_order_set_shipped originating from Subscriber-level accounts.
Unexplained changes to WooCommerce order shipment status or shipped quantity fields not tied to admin or shop-manager sessions.
Sequential enumeration patterns against admin-ajax.php where a single session iterates through incrementing order_id values.

Detection Strategies

Review WooCommerce order audit logs and database revisions for shipment field mutations performed by non-privileged users.
Correlate web server access logs with WordPress user session data to identify Subscriber accounts invoking shop-management AJAX actions.
Deploy a WordPress security plugin or web application firewall rule that inspects admin-ajax.php requests targeting the three affected action names.

Monitoring Recommendations

Alert on high-volume admin-ajax.php traffic from a single authenticated session touching the affected actions.
Monitor for new Subscriber registrations followed within minutes by AJAX activity against WooCommerce order endpoints.
Track outbound order status transition events and validate them against the initiating user's assigned role.

How to Mitigate CVE-2026-9858

Immediate Actions Required

Update the Partial Shipment for WooCommerce plugin to a version newer than 3.4 once the vendor publishes a fixed release.
Temporarily disable open user registration on affected WooCommerce sites, or restrict the default role assigned to new registrations.
Audit existing Subscriber accounts and remove or lock any accounts created shortly before or during the exposure window.

Patch Information

A vendor changeset is referenced in the WordPress Plugin Changeset. Administrators should confirm the installed plugin version is later than 3.4 and includes capability checks, nonce verification, and order ownership validation in the affected AJAX handlers.

Workarounds

Deactivate the Partial Shipment for WooCommerce plugin until a patched release is installed.
Add a web application firewall rule blocking unauthenticated or Subscriber-level requests to admin-ajax.php where the action parameter matches wxp_order_shipment, wxp_order_item_shipment, or wxp_order_set_shipped.
Restrict /wp-admin/admin-ajax.php access by IP allowlist for staff sessions if the store operates in a controlled fulfillment context.

bash

# Example ModSecurity rule to block the vulnerable AJAX actions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,id:1029858,phase:2,deny,status:403,\
    msg:'Blocked CVE-2026-9858 Partial Shipment AJAX action'"
  SecRule ARGS:action "@rx ^(wxp_order_shipment|wxp_order_item_shipment|wxp_order_set_shipped)$"