Morkva UA Shipping Security & Risk Analysis

wordpress.org/plugins/morkva-ua-shipping

Нова Пошта по Україні та закордон, Укрпошта по Україні та закордон. Rozetka Delivery. Зручне створення ТТН. Друк ТТН. Сумісний з іншими плагінами.

800 active installs v1.8.3 PHP 7.4+ WP 5.0+ Updated Mar 5, 2026
%d0%bd%d0%be%d0%b2%d0%b0-%d0%bf%d0%be%d1%88%d1%82%d0%b0nova-poshta%d1%83%d0%ba%d1%80%d0%bf%d0%be%d1%88%d1%82%d0%b0
93
A · Safe
CVEs total2
Unpatched0
Last CVEMar 3, 2026
Safety Verdict

Is Morkva UA Shipping Safe to Use in 2026?

Generally Safe

Score 93/100

Morkva UA Shipping has a strong security track record. Known vulnerabilities have been patched promptly.

2 known CVEsLast CVE: Mar 3, 2026Updated 29d ago
Risk Assessment

The "morkva-ua-shipping" plugin v1.8.4 exhibits a mixed security posture. While it has a relatively low number of entry points compared to its static analysis findings, a significant concern arises from one unprotected REST API route, which is a direct avenue for potential unauthorized access or manipulation. The presence of 5 SQL queries, none of which utilize prepared statements, is a considerable risk for SQL injection vulnerabilities. Furthermore, with 59% of outputs properly escaped, there's a substantial chance for Cross-Site Scripting (XSS) vulnerabilities to exist, especially when combined with the historical vulnerability data.

Key Concerns

  • REST API route without permission callback
  • SQL queries not using prepared statements
  • Insufficient output escaping
  • High number of flows with unsanitized paths
  • Bundled Select2 library
Vulnerabilities
2

Morkva UA Shipping Security Vulnerabilities

CVEs by Year

1 CVE in 2025
2025
1 CVE in 2026
2026
Patched Has unpatched

Severity Breakdown

Critical
1
Medium
1

2 total CVEs

CVE-2026-2292medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Morkva UA Shipping <= 1.7.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Weight, kg' Field

Mar 3, 2026 Patched in 1.7.10 (1d)
CVE-2025-24685critical · 9.8Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Morkva UA Shipping <= 1.0.18 - Unauthenticated Local File Inclusion

Jan 27, 2025 Patched in 1.0.20 (8d)
Code Analysis
Analyzed Mar 16, 2026

Morkva UA Shipping Code Analysis

Dangerous Functions
0
Raw SQL Queries
5
0 prepared
Unescaped Output
478
699 escaped
Nonce Checks
25
Capability Checks
4
File Operations
18
External Requests
16
Bundled Libraries
1

Bundled Libraries

Select2

SQL Query Safety

0% prepared5 total queries

Output Escaping

59% escaped1177 total outputs
Data Flows
9 unsanitized

Data Flow Analysis

14 flows9 with unsanitized paths
get_rozetka_city (classes\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:25)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
1 unprotected

Morkva UA Shipping Attack Surface

Entry Points49
Unprotected1

AJAX Handlers 48

authwp_ajax_mrkv_ua_ship_clear_logclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:36
noprivwp_ajax_mrkv_ua_ship_clear_logclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:37
authwp_ajax_mrkv_ua_ship_get_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:39
noprivwp_ajax_mrkv_ua_ship_get_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:40
authwp_ajax_mrkv_ua_ship_create_invoiceclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:42
noprivwp_ajax_mrkv_ua_ship_create_invoiceclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:43
authwp_ajax_mrkv_ua_ship_update_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:45
noprivwp_ajax_mrkv_ua_ship_update_order_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:46
authwp_ajax_mrkv_ua_ship_update_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:48
noprivwp_ajax_mrkv_ua_ship_update_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:49
authwp_ajax_mrkv_ua_ship_remove_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:51
noprivwp_ajax_mrkv_ua_ship_remove_invoice_dataclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:52
authwp_ajax_mrkv_ua_ship_remove_all_invoicesclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:54
noprivwp_ajax_mrkv_ua_ship_remove_all_invoicesclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:55
authwp_ajax_mrkv_update_shipping_methodclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:57
noprivwp_ajax_mrkv_update_shipping_methodclasses\shipping_methods\mrkv-ua-shipping-methods-ajax.php:58
authwp_ajax_mrkv_ua_ship_nova_global_warehouseclasses\shipping_methods\nova-global\ajax\mrkv-ua-shipping-methods-ajax-nova-global.php:18
noprivwp_ajax_mrkv_ua_ship_nova_global_warehouseclasses\shipping_methods\nova-global\ajax\mrkv-ua-shipping-methods-ajax-nova-global.php:19
authwp_ajax_mrkv_ua_ship_nova_poshta_areaclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:18
noprivwp_ajax_mrkv_ua_ship_nova_poshta_areaclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:19
authwp_ajax_mrkv_ua_ship_nova_poshta_cityclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:21
noprivwp_ajax_mrkv_ua_ship_nova_poshta_cityclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:22
authwp_ajax_mrkv_ua_ship_nova_poshta_warehouseclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:24
noprivwp_ajax_mrkv_ua_ship_nova_poshta_warehouseclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:25
authwp_ajax_mrkv_ua_ship_nova_poshta_streetclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:27
noprivwp_ajax_mrkv_ua_ship_nova_poshta_streetclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:28
authwp_ajax_mrkv_ua_ship_nova_poshta_street_defaultclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:30
noprivwp_ajax_mrkv_ua_ship_nova_poshta_street_defaultclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:31
authwp_ajax_mrkv_ua_ship_nova_poshta_sender_get_address_refclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:33
noprivwp_ajax_mrkv_ua_ship_nova_poshta_sender_get_address_refclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:34
authwp_ajax_mrkv_ua_ship_novapost_divisionsclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:36
noprivwp_ajax_mrkv_ua_ship_novapost_divisionsclasses\shipping_methods\nova-poshta\ajax\mrkv-ua-shipping-methods-ajax-nova.php:37
authwp_ajax_mrkv_ua_ship_rozetka_delivery_cityclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:18
noprivwp_ajax_mrkv_ua_ship_rozetka_delivery_cityclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:19
authwp_ajax_mrkv_ua_ship_rozetka_delivery_warehouseclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:21
noprivwp_ajax_mrkv_ua_ship_rozetka_delivery_warehouseclasses\shipping_methods\rozetka-delivery\ajax\mrkv-ua-shipping-methods-ajax-rozetka.php:22
authwp_ajax_mrkv_ua_ship_ukr_poshta_cityclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:18
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_cityclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:19
authwp_ajax_mrkv_ua_ship_ukr_poshta_warehouseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:21
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_warehouseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:22
authwp_ajax_mrkv_ua_ship_ukr_poshta_streetclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:24
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_streetclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:25
authwp_ajax_mrkv_ua_ship_ukr_poshta_houseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:27
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_houseclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:28
authwp_ajax_mrkv_ua_ship_ukr_poshta_warehouse_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:30
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_warehouse_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:31
authwp_ajax_mrkv_ua_ship_ukr_poshta_address_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:33
noprivwp_ajax_mrkv_ua_ship_ukr_poshta_address_idclasses\shipping_methods\ukr-poshta\ajax\mrkv-ua-shipping-methods-ajax-ukr.php:34

REST API Routes 1

GET/wp-json/mrkv_ua_shipping/v1/check_ttnclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:27
WordPress Hooks 35
actionadmin_enqueue_scriptsclasses\settings\admin\mrkv-ua-shipping-admin-assets.php:19
actionadmin_menuclasses\settings\admin\mrkv-ua-shipping-menu.php:25
actionadmin_initclasses\settings\admin\mrkv-ua-shipping-notification.php:18
actionadmin_noticesclasses\settings\admin\mrkv-ua-shipping-notification.php:19
actionadmin_initclasses\settings\global\mrkv-ua-shipping-options.php:19
actionwoocommerce_order_status_changedclasses\shipping_methods\mrkv-ua-shipping-methods-autocreate.php:19
actionwoocommerce_checkout_order_processedclasses\shipping_methods\mrkv-ua-shipping-methods-autocreate.php:22
actionwoocommerce_checkout_processclasses\shipping_methods\mrkv-ua-shipping-methods-checkout-validation.php:43
filterwoocommerce_checkout_fieldsclasses\shipping_methods\mrkv-ua-shipping-methods-checkout-validation.php:44
actionwoocommerce_before_checkout_formclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:26
filterwoocommerce_cart_shipping_packagesclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:27
filterwoocommerce_checkout_fieldsclasses\shipping_methods\mrkv-ua-shipping-methods-checkout.php:28
actionwp_loadedclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:19
actionmrknp_ua_shipping_nova_poshta_statusesclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:20
actionrest_api_initclasses\shipping_methods\mrkv-ua-shipping-methods-cron.php:22
actionwoocommerce_checkout_create_orderclasses\shipping_methods\mrkv-ua-shipping-methods-order.php:18
actionwp_loadedclasses\shipping_methods\mrkv-ua-shipping-methods.php:31
actionadd_meta_boxesclasses\woocommerce\mrkv-ua-shipping-woo-order.php:21
actionwoocommerce_admin_order_data_after_billing_addressclasses\woocommerce\mrkv-ua-shipping-woo-order.php:23
actionwoocommerce_admin_order_data_after_shipping_addressclasses\woocommerce\mrkv-ua-shipping-woo-order.php:24
actionwoocommerce_process_shop_order_metaclasses\woocommerce\mrkv-ua-shipping-woo-order.php:25
filtermanage_woocommerce_page_wc-orders_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:22
actionmanage_woocommerce_page_wc-orders_custom_columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:23
filtermanage_edit-shop_order_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:26
actionmanage_shop_order_posts_custom_columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:27
actionadmin_footerclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:30
filterwoocommerce_account_orders_columnsclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:32
actionwoocommerce_my_account_my_orders_column_mrkv_ua_ship_ttn-columnclasses\woocommerce\mrkv-ua-shipping-woo-orders.php:33
filterwoocommerce_product_data_tabsclasses\woocommerce\mrkv-ua-shipping-woo-product.php:21
actionwoocommerce_product_data_panelsclasses\woocommerce\mrkv-ua-shipping-woo-product.php:22
actionwoocommerce_process_product_metaclasses\woocommerce\mrkv-ua-shipping-woo-product.php:23
actionbefore_woocommerce_initmrkv-ua-shipping.php:20
actioninitmrkv-ua-shipping.php:49
actionwoocommerce_shipping_initmrkv-ua-shipping.php:52
filterwoocommerce_shipping_methodsmrkv-ua-shipping.php:78
Maintenance & Trust

Morkva UA Shipping Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 5, 2026
PHP min version7.4
Downloads16K

Community Trust

Rating98/100
Number of ratings22
Active installs800
Developer Profile

Morkva UA Shipping Developer Profile

Ihor Kit

14 plugins · 3K total installs

93
trust score
Avg Security Score
98/100
Avg Patch Time
11 days
View full developer profile
Detection Fingerprints

How We Detect Morkva UA Shipping

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/morkva-ua-shipping/assets/css/global/global-mrkv-ua-shipping.css/wp-content/plugins/morkva-ua-shipping/assets/js/global/select2.min.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js/wp-content/plugins/morkva-ua-shipping/assets/css/nova-poshta/nova-poshta-mrkv-ua-shipping.css/wp-content/plugins/morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/css/ukrposhta/ukrposhta-mrkv-ua-shipping.css+1 more
Script Paths
/wp-content/plugins/morkva-ua-shipping/assets/js/global/select2.min.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js/wp-content/plugins/morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js/wp-content/plugins/morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js/wp-content/plugins/morkva-ua-shipping/assets/js/ukrposhta/ukrposhta-mrkv-ua-shipping.js
Version Parameters
morkva-ua-shipping/assets/css/global/global-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/global/select2.min.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-nova-poshta.js?ver=morkva-ua-shipping/assets/js/global/global-mrkv-ua-shipping-ukrposhta.js?ver=morkva-ua-shipping/assets/css/nova-poshta/nova-poshta-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/nova-poshta/nova-poshta-mrkv-ua-shipping.js?ver=morkva-ua-shipping/assets/css/ukrposhta/ukrposhta-mrkv-ua-shipping.css?ver=morkva-ua-shipping/assets/js/ukrposhta/ukrposhta-mrkv-ua-shipping.js?ver=

HTML / DOM Fingerprints

CSS Classes
mrkv-ua-shipping-admin-settingsmrkv-ua-shipping-order-details
Data Attributes
data-nonce-field
JS Globals
mrkv_ua_ship_helperMRKV_UA_SHIPPING_PLUGIN_VERSION
FAQ

Frequently Asked Questions about Morkva UA Shipping