The vulnerability lies in an AJAX action within the Shipping for Nova Poshta plugin that performs no authorization, nonce, or ownership checks. As a result, an unauthenticated user can trigger deletion of shipment records for any order. This leads to loss of critical shipping data, may cause the store to send waybill‑deletion requests with compromised credentials, and destroys the integrity of the order history. The flaw is an example of improper access control that permits modification of protected resources without authentication.

The issue exists in Shipping for Nova Poshta WordPress plugin versions 1.18.7 through 1.19.8. System administrators using any of these releases on WordPress sites are exposed to the attack.

The CVSS score of 5.3 indicates moderate severity, but the absence of an EPSS score and no KEV listing imply limited public exploit data. However, the attack vector is purely remote over HTTP, requires no privileges, and can be executed by any visitor to the site. An attacker could silence shipment records, creating operational disruptions and potentially exposing the store’s API credentials to the carrier if the deletion request is misused. The risk is amplified on sites with active shipping workflows.