CVE-2026-9858 Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxpordershipment, wxporderitemshipment, and wxpordersetshipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php register...

CVE-2026-9858 Partial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxpordershipment, wxporderitemshipment, and wxpordersetshipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php register...

PT-2026-95809

Name of the Vulnerable Software and Affected Versions Partial Shipment for Woocommerce versions prior to 3.5 Description Missing authorization in the plugin allows authenticated users with Subscriber-level access and above to access and modify order data. The issue exists within the...