Live › vulnerability › CVE-2026-120558
The Advanced Shipment Tracking for WooCommerce plugin for WordPress builds part of a database query from the tracking_provider field of its REST endpoint without escaping it. An attacker with Shop Manager access or higher can append extra SQL to extract sensitive data from the site's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Sites running the Advanced Shipment Tracking for WooCommerce plugin at version 3.9 or earlier are exposed. Exploitation requires an account with Shop Manager access or higher, so stores that restrict those roles to trusted staff have lower exposure. Sites that do not run this plugin are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| woo-advanced-shipment-tracking | wordpress | <= 3.9 | 3.9.1 |
3.9.1 or later; the current stable release on GitHub is 4.0.44.0.1 or later, because a separate SQL injection (CVE-2026-57773) affects versions up to 4.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the tracking_provider parameter of the POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name() — the value is concatenated directly into the format string of $wpdb->prepare() rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.
This page as .md · .json · in your agent: get_signal("CVE-2026-120558")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.