CVE-2026-65504

Executive Summary

CVE-2026-65504 is a broken access control vulnerability in the WordPress BOX NOW Delivery Croatia plugin, affecting all versions up to and including 3.3.0. The flaw allows unauthenticated attackers to bypass authorization checks, potentially accessing sensitive functionality or data exposed by the plugin. The vulnerability carries a CVSS score of 7.5 (High), reflecting network-based exploitation with no prerequisites, and the vendor has identified version 3.3.1 as the initial patched release.

Technical Analysis

The vulnerability is classified under CWE-862 (Missing Authorization) and affects the BOX NOW Delivery Croatia plugin for WordPress, version 3.3.0 and earlier. According to the CNA title and NVD description, the issue is an Unauthenticated Broken Access Control vulnerability. This means the plugin fails to properly enforce authorization checks on certain functions or endpoints, allowing unauthenticated users to invoke functionality that should require authentication or specific user roles.

The vulnerability mechanism is characteristic of broken access control in WordPress plugins: the plugin registers AJAX actions, REST API endpoints, or administrative functions that either lack permission callbacks entirely, or use current_user_can() checks incorrectly (e.g., checking with default true return values, using is_user_logged_in() which can be bypassed, or missing nonce verification combined with admin_post_* hooks). In this specific case, the flaw permits unauthenticated access to functionality that processes data, likely shipping/parcel delivery tracking or order-related data, which could include sensitive customer information.

The attack surface is the WordPress installation's HTTP interface, specifically the plugin's registered endpoints. Because the vulnerability is unauthenticated (AV:N, PR:N), no special access prerequisites are required beyond network reachability. The plugin's functions likely expose order information, delivery status, or caller data through either admin-ajax calls or custom REST routes without proper permission verification.

Exploitation Scenarios

Step 1 — Reconnaissance (Target Identification): An attacker enumerates WordPress sites running the BOX NOW Delivery Croatia plugin using search engines and vulnerability scanners. The plugin's presence can be identified by:

• Inspecting page source for plugin-specific CSS/JavaScript file references
• Querying the WordPress REST API endpoint wp-json/wp/v2/plugins (if exposed)
• Checking for the plugin's typical delivery form functionality on checkout pages
• Using search engine dorks: "box now" intitle:"delivery croatia" inurl:"wp-content/plugins"

Step 2 — Endpoint Identification: The attacker uses directory enumeration or inspects the plugin's public-facing JavaScript files to locate AJAX action handlers or REST endpoints. These endpoints are often invoked via admin-ajax.php with action parameters specific to the plugin (e.g., action=boxnow_get_delivery_status or action=boxnow_fetch_tracking). The attacker tests these endpoints without providing any authentication cookies.

Step 3 — Trigger/Weaponization: The attacker crafts a direct HTTP request to the WordPress admin-ajax.php or REST API endpoint. Since the plugin lacks proper authorization checks, the request is processed without authentication. Example request structure:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=<plugin_action>&order_id=12345

The attacker enumerates order IDs or other parameters to access records that should be protected. Because the flaw is unauthenticated and no user interaction is required (UI:N), no social engineering is needed.

Step 4 — Post-Exploitation Impact: Successful exploitation yields unauthorized read access to sensitive data exposed by the plugin. Given BOX NOW is a delivery/courier plugin for Croatia, this data may include customer names, addresses, order delivery details, tracking numbers, and potentially package contents — all considered confidentiality-impacting (C:H). The attacker may also identify additional functionality, such as the ability to modify delivery preferences or trigger actions on behalf of legitimate users, depending on which functions lack authorization controls.

Impact Assessment

CVSS Breakdown:

• Attack Vector (AV:N): Remote exploitation over the network
• Attack Complexity (AC:L): Low — no special conditions or race conditions required
• Privileges Required (PR:N): None — unauthenticated
• User Interaction (UI:N): None required
• Impact on Confidentiality (C:H): HIGH — sensitive data exposure
• Impact on Integrity (I:N): None — read-only in this vector
• Impact on Availability (A:N): None

Business Impact: Successful exploitation can lead to unauthorized disclosure of customer data handled by the plugin. For e-commerce sites using BOX NOW delivery, this potentially includes personal customer information collected during checkout (addresses, phone numbers, delivery preferences) and order metadata. The exposure could trigger GDPR notification requirements under EU data protection law for Croatian and other EU-based merchants, as customer PII would be compromised.

Affected Systems: All WordPress installations running BOX NOW Delivery Croatia plugin version 3.3.0 and earlier. The exact number of installations is unknown, but the plugin serves a regional e-commerce market in the Adriatic region.

Blast Radius: Limited to the plugin's exposed data and functions — the vulnerability does not directly grant administrative access or code execution. However, the leaked PII can be leveraged for targeted phishing campaigns, and if the plugin exposes additional undocumented functionality, the impact could expand.

CISA KEV: No. EPSS: Not yet scored.

Detection Guidance

Due to the unauthenticated nature of this vulnerability and the lack of a public PoC, network-level detection is best focused on anomalous patterns of requests to plugin-specific endpoints from unauthenticated sessions at scale. Web application firewall (WAF) rules and Wazuh/Sigma detections below rely on identifying batch enumeration behavior typical of attackers probing for data.

Sigma Rule

title: WordPress BOX NOW Croatia Plugin Unauthenticated Data Access
id: 55f0a4c2-9f3b-4e6d-8a10-7e1d3c6a9f2b
status: experimental
description: Detects burst enumeration of BOX NOW Delivery Croatia plugin endpoints by unauthenticated users, indicating attempted exploitation of CVE-2026-65504
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65504
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-65504
logsource:
    category: webserver
    product: httpd
detection:
    selection:
        cs-uri-query|contains|all:
            - 'admin-ajax.php'
            - 'action=boxnow'
    filter_authenticated:
        cs-uri-query|contains: 'wpnonce='
    filter_admin:
        cs-uri-query|contains: 'wp-admin/admin-ajax.php'
    condition: selection and (not filter_authenticated)
    timeframe: 30s
   count_full:
        selection with count(source_ip) > 20
field_mappings:
    - field: cs-uri-query
      value: "HTTP request query string"
level: high
falsepositives:
    - Legitimate login-less AJAX calls (plugin may use them for tracking widget)

YARA Rule

rule CVE_2026_65504_BoxNow_Endpoint_Probe
{
    meta:
        author = "ThreatIntel Analyst"
        date = "2026-05-15"
        description = "Detects HTTP requests probing for BOX NOW Delivery Croatia plugin unauthenticated endpoints"
        cve = "CVE-2026-65504"
        severity = "high"
    strings:
        $a1 = "action=boxnow" ascii wide nocase
        $a2 = "admin-ajax.php" ascii wide nocase
        $a3 = "wp-admin/admin-post.php" ascii wide nocase
        $a4 = "boxnow_" ascii wide nocase
        $a5 = "delivery-croatia" ascii wide nocase
        $a6 = "box-now" ascii wide nocase
        $b1 = "wpnonce" ascii wide nocase
    condition:
        filesize < 10KB and
        (2 of ($a*) in 0..2000) and
        (not $b1)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT WordPress BOX NOW Delivery Croatia Plugin CVE-2026-65504 Unauthenticated Access Detection"; flow:established,to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; nocase; content:"action=boxnow"; http_uri; nocase; pcre:"/^action=boxnow_[a-z_]+$/Ui"; threshold: type threshold, track by_src, count 15, seconds 10; classtype:attempted-recon; reference:cve,2026-65504; sid:2026006550; rev:1;)

Additional rule for REST API variant:

alert http any any -> any any (msg:"ET EXPLOIT BOX NOW Plugin REST API Unauthenticated Probe"; flow:established,to_server; content:"GET"; http_method; content:"wp-json/"; http_uri; nocase; content:"boxnow"; http_uri; nocase; classtype:attempted-recon; reference:cve,2026-65504; sid:2026006551; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where event.type == "start" and
    destination.port == 443 and
    http.request.method == "POST" and
    url.path == "/wp-admin/admin-ajax.php" and
    url.query : "*action=boxnow*" ]
  [ network where event.type == "start" and
    destination.port == 443 and
    http.request.method == "POST" and
    url.path == "/wp-admin/admin-ajax.php" and
    url.query : "*action=boxnow*" ]
  [ network where event.type == "start" and
    destination.port == 443 and
    http.request.method == "POST" and
    url.path == "/wp-admin/admin-ajax.php" and
    url.query : "*action=boxnow*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%admin-ajax.php%") OR like(uri_path, "%wp-json%")
| where like(uri_query, "%boxnow%") OR like(uri_query, "%box-now%")
| where NOT like(uri_query, "%wpnonce%")
| stats count as request_count by src_ip, uri_path, uri_query
| where request_count > 15
| eval detection = "Potential CVE-2026-65504 exploitation"
| convert ctime(_time) as timestamp
| table _time, src_ip, dest_ip, uri_path, uri_query, request_count, detection

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100210" level="12" frequency="15" timeframe="30">
    <if_sid>3154</if_sid>
    <match>admin-ajax.php</match>
    <match>action=boxnow</match>
    <description>WordPress: High-frequency unauthenticated requests to BOX NOW Delivery Croatia plugin endpoints - potential CVE-2026-65504 exploitation</description>
    <group>web_application_attack,wordpress,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="100211" level="10" frequency="25" timeframe="60">
    <if_sid>3154</if_sid>
    <match>wp-json</match>
    <match>boxnow</match>
    <description>Possible enumeration of BOX NOW plugin REST endpoints</description>
    <group>wordpress,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed)

1. Immediate Mitigations:

   • Until the patch is applied, block/disable the plugin's AJAX endpoints via a WAF or Apache/Nginx rule if the site does not use the unauthenticated functionality legitimately.
   • Disable XML-RPC if not required, as it can amplify brute-force/probing attempts.
   • Monitor access logs for unusual request volumes to references of boxnow or action=boxnow from single IPs.
   • Consider removing or deactivating the plugin if it is not actively used for delivery services.

2. Patch/Upgrade Steps:

   • Navigate to WordPress Admin → Plugins → Installed Plugins.
   • Locate BOX NOW Delivery Croatia.
   • If an update notice is available, select Update Now. Otherwise, download the latest version from the WordPress plugin repository, or contact the vendor (Patchstack CNA) for the fixed release.
   • Target version: Update to version 3.3.1 or higher.
   • After the update, test the checkout/delivery flow to ensure the plugin's core functionality remains intact.

3. Long-Term Hardening:

   • Implement a WordPress security policy that requires regular plugin updates — automate updates within a 24-hour window for high-severity CVEs.
   • Add a Web Application Firewall (WAF) rule to block unauthenticated requests to any newly-registered plugin endpoints that do not require authentication.
   • Conduct periodic authorization audits of all installed plugins using tools like WPScan to identify missing capability checks.
   • Subscribe to the Patchstack vulnerability database or CVE feeds to receive timely vulnerability notifications for the WordPress plugin stack.
   • Restrict WordPress REST API exposure to only the necessary routes, and require authentication where feasible.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-65504 (Official CVE description, CVSS vector, and reference data)
2. CWE-862 — https://cwe.mitre.org/data/definitions/862.html (Missing Authorization weakness definition — the root cause of this vulnerability)
3. Patchstack — https://patchstack.com/database/ (CNA — primary source of vulnerability disclosure; check for the advisory on CVE-2026-65504)
4. WordPress Plugin Repository — https://wordpress.org/plugins/ (Official plugin directory to retrieve patched version 3.3.1)
5. ATT&CK Technique T1190 — https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application — the MITRE ATT&CK mapping for unauthorized access via exposed application flaws)

Threat Actor Activity: As of the writing of this report, no active exploit campaigns in the wild have been documented for CVE-2026-65504. The CISA KEV catalog does not list this vulnerability, and no public PoC or exploit code is known. However, the unauthenticated nature of the flaw and the high confidentiality impact make it a viable target for commodity botnets and opportunistic attackers once proof-of-concept code surfaces.