Partial Shipment for WooCommerce

Partial Shipment for WooCommerce has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 6.5 out of 10.

The most common weakness is Missing Authorization, behind 1 of the records (50%). Other recurring categories include SQL Injection.

Every one of the 2 issues recorded for Partial Shipment for WooCommerce has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Partial Shipment for WooCommerce is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Partial Shipment for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2025-48118

Woocommerce Partial Shipment <= 3.2 - Authenticated (Subscriber+) SQL Injection

Read the full analysis

Vulnerability Records

2 records
Partial Shipment for WooCommerce banner
Latestv3.8

Partial Shipment for WooCommerce

WpExperts Hub

Author

WpExperts Hub

4.4(9)
88/100
Last Updated
2026-10-06 (22d ago)
Active Installs
1,000+
Downloads
29,193
Requires WP
6.5+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2018-05-03 (9y ago)
Requires Plugins
woocommerce

Not every order ships in one go. Items can be out of stock or on backorder, come from different suppliers or simply need more than one parcel. Partial Shipment for WooCommerce lets you record exactly what has shipped for each order item, keeps the order status up to date and shows your customers what is on its way and what is still to come. Why use Partial Shipment for WooCommerce? Always know what is left to ship – shipped and remaining quantities of every item, right on the order screen. Fewer “where is the rest of my order?” emails – customers see a shipment badge next to each item on their order page. The order status follows the shipment – Partially Shipped while items are still to ship, Completed when everything has gone (both optional). Refunds are taken into account – refunded quantities no longer count as “to ship”, so orders still complete correctly. How it works Open an order and click Shipment under the order items. Set the shipped quantity of each item, or click “Ship everything”, and save. The order status follows the shipment: Partially Shipped while items are still to ship, Completed once everything has shipped. Each item gets a shipment badge on the order screen and on the customer’s order page, and you can email the customer from the order actions. Features Shipment popup on the order screen – quantity stepper per item, progress summary, product image and SKU, “Ship everything” and “Clear all”, and one Save button. The pencil icon of an item opens the same popup for that item only. “Partially Shipped” order status (optional) and automatic completion when every item has shipped (optional). Orders waiting for payment, and cancelled, refunded or failed orders, are never moved. Shipment badges – Shipped, Partially Shipped, Not Shipped and Refunded, with quantities, on the order screen, in the order preview on the Orders list and on the customer’s View Order page. Refund-aware – refunded quantities no longer count as “to ship”, fully refunded items show “Refunded”, and virtual items need no shipping. Customer email – send the “Partial shipment order” email, with the shipped and remaining items, from Order actions > Partial shipment notification. Edit it under WooCommerce > Settings > Emails. Existing orders – one click creates shipment records for older orders of the statuses you choose. Large stores are processed in the background in batches. Manual completion – completing an order by hand marks all of its items as shipped. Works with High-Performance Order Storage (HPOS), the Cart and Checkout blocks and multisite. Translation ready. Privacy Shipment records (order, items and shipped quantities) are stored in two tables in your own WordPress database. The plugin adds no tracking, sets no cookies and sends no data to external services. ⭐ Premium: Advance Partial Shipment for WooCommerce Give customers tracking for every parcel. The premium version adds tracking numbers, shipment emails and a tracking page, so customers always know where each part of their order is. ✅ Multiple shipments per order – each with its own tracking number, tracking URL and shipping provider. ✅ Shipping providers – built-in carriers for each country, plus your own providers and tracking URLs. ✅ Shipment statuses – Ready, Picked, Dispatched and Delivered, with the delivery date recorded. ✅ Automatic shipment emails with tracking details, sent when a shipment is created or when it is marked as Picked. ✅ Estimated delivery date, customer notes and internal notes for each shipment. ✅ Customer tracking – a shipment timeline on the customer’s order page and a public tracking page (shortcode). ✅ Packing slips and delivery notes for each shipment (with the free PDF Invoice for WooCommerce plugin). ✅ REST API and webhooks to connect your warehouse or other systems. ✅ Fulfillment Report with CSV export. ✅ Bulk shipments and backfill of existing orders. ✅ Data retention – old shipment data can be removed automatically. ✅ Dedicated support from the plugin developers. 👉 Get Advance Partial Shipment for WooCommerce For developers wxp_partial_shipment_labels filter – the badge labels. wxp_partial_shipping_settings filter – the settings fields. wxp_backfill_batch_size filter – orders per background batch when creating records for existing orders (default 50). wxp_order_status action – fires when the shipment of an order changes ($order_id); the plugin updates the order status on it. Email template override: copy emails/customer-partial-shipment.php to yourtheme/woocommerce/emails/customer-partial-shipment.php.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C