CVE-2026-84836

CVE-2026-84836 is an Insecure Direct Object References (IDOR) flaw (CWE-639) in the WC Ukraine Shipping plugin for WordPress/WooCommerce, affecting all versions up to and including 1.22.3. An attacker who holds (or registers, if open registration is enabled) a subscriber-level account on an affected site can send requests referencing other users' or records' object identifiers and access data belonging to other accounts. Per the CVSS vector, the attacker gains high-confidence read access to sensitive information plus limited ability to modify data, with no user interaction required beyond the authenticated request. Only WordPress sites running WC Ukraine Shipping 1.22.3 or older are affected. There is currently no public proof-of-concept, no known in-the-wild exploitation, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at just 0.2% (13th percentile).

What to do: Sites running WC Ukraine Shipping 1.22.3 or older should update to the first patched release after 1.22.3 (a specific fixed version number is not stated in the available data — verify the current version on the plugin's WordPress.org listing). Because exploitation requires subscriber-level authentication, the practical risk is highest on sites with open registration or many low-privilege accounts; audit subscriber accounts and restrict self-registration until patched. If no update is available, consider temporarily deactivating the plugin.