Description

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-19T09:16:35.350Z",
  "pubdate": "2026-09-19T09:16:35.350Z",
  "executiveSummary": "The Partial Shipment for Woocommerce plugin for WordPress contains a critical Missing Authorization vulnerability in versions 3.4 and earlier.\nThe vulnerability originates from a lack of capability checks, nonce verification, and object ownership validation within key AJAX action handlers.\nThis flaw allows authenticated users, including those with minimal Subscriber-level privileges, to interact with the plugin's administrative functions.\nAttackers can leverage this to perform unauthorized actions such as accessing sensitive order data or modifying shipment statuses across the entire platform.\nThe impact is significant, as it enables unauthorized data disclosure and the manipulation of order fulfillment workflows, potentially leading to inventory discrepancies or unauthorized status transitions in WooCommerce.\nExploitation requires no elevated privileges beyond an active authenticated session on the WordPress installation.",
  "technicalDetails": "The vulnerability resides within the woocommerce-partial-shipment.php file, specifically affecting the AJAX handlers registered for the 'wxp_order_shipment', 'wxp_order_item_shipment', and 'wxp_order_set_shipped' actions.\nThese handlers, implemented at lines 228, 263, and 291 respectively, fail to implement the security best practices required for WordPress AJAX operations.\nThe root cause is the absence of wp_verify_nonce() checks, which are necessary to prevent Cross-Site Request Forgery (CSRF), and the omission of current_user_can() checks, which are required to enforce access control based on user roles and capabilities.\nFurthermore, the implementation fails to validate that the 'order_id' supplied by the user corresponds to an order owned by or accessible to that user.\nAn attack flow begins when an authenticated Subscriber sends a crafted HTTP POST request to the WordPress admin-ajax.php endpoint. By specifying the target AJAX action and providing an arbitrary 'order_id' as a parameter, the attacker can force the application to execute functions intended solely for shop managers or administrators.\nThrough the 'wxp_order_shipment' and 'wxp_order_item_shipment' actions, an attacker can extract sensitive order details, including product names, specific quantities, and existing shipment tallies for any order within the system, leading to unauthorized information disclosure.\nThe 'wxp_order_set_shipped' action allows the attacker to arbitrarily modify the shipment status and quantities of any order. Because these functions can trigger the 'wxp_order_status' action, the attacker can influence the WooCommerce order status transition logic, potentially causing orders to be incorrectly marked as completed or processed.\nThis vulnerability exposes the integrity of the store's fulfillment process and customer privacy. Given that the affected functions operate on the server-side, the attacker can systematically iterate through sequential order IDs to exfiltrate or modify data for all store orders, effectively bypassing all intended application-level access controls."
}