CVE-2026-9858 describes a missing authorization vulnerability (CWE-862) in the Partial Shipment for WooCommerce plugin for WordPress, affecting versions up to and including 3.4. The vulnerability arises because the AJAX handlers (wxp_order_shipment, wxp_order_item_shipment, wxp_order_set_shipped) lack capability checks, nonce verification, and do not validate the ownership of the order_id parameter. Consequently, authenticated attackers with Subscriber-level privileges or higher can read arbitrary order item details and modify shipment statuses of any order, potentially triggering order status transitions.

The vulnerability allows authenticated users with low privileges (Subscriber and above) to access and modify shipment information of any order, including reading order item names, quantities, and shipped counts. This unauthorized access and modification can disrupt order processing and integrity but does not directly impact confidentiality of order contents or availability of the system. The CVSS score is 4.3 (medium severity) reflecting limited impact on confidentiality and no impact on availability.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict user roles and permissions to trusted users only and consider disabling or limiting access to the affected AJAX actions if possible. Avoid granting Subscriber-level or higher access to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.