CVE-2026-9858

Name of the Vulnerable Software and Affected Versions Partial Shipment for Woocommerce versions prior to 3.5

Description Missing authorization in the plugin allows authenticated users with Subscriber-level access and above to access and modify order data. The issue exists within the woocommerce-partial-shipment.php file due to a lack of capability checks, nonce verification, and failure to validate if the calling user owns the supplied order id. Attackers can read arbitrary order item details, such as names, quantities, and shipped counts, and modify shipment status or shipped quantities. This can also trigger order status transitions via the wxp order status action. The affected AJAX actions are 'wxp order shipment', 'wxp order item shipment', and 'wxp order set shipped'.

Recommendations Update Partial Shipment for Woocommerce to version 3.5 or later.