Mmastodon TechnologyCybersecurity first seen 10 h ago, last 10 h ago, peak #12

Security flaw reported in Nova Poshta WordPress shipping plugin

Original: 🚨 EUVD-2026-95707 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: Shipping for Nova Poshta 🏢 Vendor: Unknown 📅 Updated: 2026-10-0

A medium-severity vulnerability, EUVD-2026-95707, has been disclosed in the Shipping for Nova Poshta WordPress plugin, affecting versions through 1.19.8. The flaw, rated 5.3 out of 10 under CVSS v3.1, stems from a missing authorisation check: an AJAX action performs no nonce, authorisation or ownership verification, potentially letting unauthorised users trigger the action. Site owners using the Ukrainian delivery service's plugin are advised to watch for a patched release.

Why now: A newly published vulnerability advisory for a widely used WordPress plugin is circulating among security watchers.

Nova PoshtaShipping for Nova Poshta pluginWordPressENISA EUVD

Open on mastodon →

Evidence

• 🚨 EUVD-2026-95707 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: Shipping for Nova Poshta 🏢 Vendor: Unknown 📅 Updated: 2026-10-09 📝 The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/1606633