Vulnerability alerts / November 3, 2026

Vulnerability in Advanced Shipment Tracking for WooCommerce — CVE-2026-120558

HighSeverity
CVSS 7.2

0.3%Estimated exploit probability
EPSS

70,000+ sitesInstalls

3.9.1Fixed in

What to do now

Update Advanced Shipment Tracking for WooCommerce to 3.9.1 or later.

Affected versions

Everything up to and including 3.9

Affected: Advanced Shipment Tracking for WooCommerce (plugin, woo-advanced-shipment-tracking)

Check: The plugin on wordpress.org / Our record for Advanced Shipment Tracking for WooCommerce

What the vulnerability is

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.

This description is reproduced verbatim from the public vulnerability record.

Sources

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.

See other alerts