{"id":"CVE-2026-120558","kind":"vulnerability","aliases":["CVE-2026-120558"],"related":[],"title":"WordPress WooCommerce shipment tracking plugin: SQL injection via REST endpoint","description":"The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.","summary":"The Advanced Shipment Tracking for WooCommerce plugin for WordPress builds part of a database query from the tracking_provider field of its REST endpoint without escaping it. An attacker with Shop Manager access or higher can append extra SQL to extract sensitive data from the site's database.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"woo-advanced-shipment-tracking","fixed":["3.9.1"],"affected":"<= 3.9","ecosystem":"wordpress"}],"ecosystems":[],"tags":["advanced-shipment-tracking","package","woocommerce","wordpress"],"not_affected_if":["no-shop-manager-accounts","plugin-above-3.9","plugin-not-installed"],"how_to_check":"- In WordPress admin go to Plugins > Installed Plugins and read the version of Advanced Shipment Tracking for WooCommerce (slug woo-advanced-shipment-tracking). 3.9 or lower is affected; 3.9.1 or later has the fix.\n- The vulnerable route is POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings (tracking_provider parameter). Exploitation needs a Shop Manager or higher account, so also review who holds that role.","fix":"Update Advanced Shipment Tracking for WooCommerce to 3.9.1 or later; the current stable release on GitHub is 4.0.4. Move to 4.0.1 or later, because a separate SQL injection (CVE-2026-57773) affects versions up to 4.0.","status":"open","published_at":"2026-11-03T05:18:33+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:49:54+00:00","updated_at":"2026-11-03T05:50:51+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T05:49:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress WooCommerce shipment tracking plugin: SQL injection via REST endpoint","impact":"high","summary":"The Advanced Shipment Tracking for WooCommerce plugin for WordPress builds part of a database query from the tracking_provider field of its REST endpoint without escaping it. An attacker with Shop Manager access or higher can append extra SQL to extract sensitive data from the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","advanced-shipment-tracking"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Database contents, including customer and order data, can be extracted by an attacker","analyst_note":"Confirm the patched plugin version and vendor fix; the sources give no fixed release, only the affected range up to and including 3.9.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins; the sources say versions up to and including `3.9` are affected.\n- Confirm whether the plugin is active on the site, since the flaw is in the plugin's REST route `/wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-above-3.9","no-shop-manager-accounts"],"who_is_affected":"Sites running the Advanced Shipment Tracking for WooCommerce plugin at version 3.9 or earlier are exposed. Exploitation requires an account with Shop Manager access or higher, so stores that restrict those roles to trusted staff have lower exposure. Sites that do not run this plugin are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4331,"output_tokens":641,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patched plugin version and vendor fix; the sources give no fixed release, only the affected range up to and including 3.9.","search":"'-120558':13A,16A '-2026':12A,15A '/shipment-trackings':100C '/wp-json/wc-ast/v3/orders':99C '3.9':110C 'access':61B,179C 'addit':184C 'admin':138C 'advanc':23B,30B,78C,135C 'advanced':19A 'advanced-shipment-track':22B 'alreadi':190C 'already-exist':189C 'append':65B,183C 'attack':57B,173C 'authent':172C 'bound':158C 'build':38B 'bypass':162C 'concaten':147C 'cve':11A,14A 'data':71B 'databas':42B,76B,203C 'direct':148C 'due':113C 'endpoint':10A,52B,102C 'escap':54B,116C 'exist':130C,191C 'extra':66B 'extract':69B,198C 'field':48B 'format':151C 'get':139C 'higher':63B 'includ':109C 'inform':200C 'inject':7A,90C 'insuffici':115C 'lack':124C 'level':178C 'make':168C 'manag':60B,177C 'manager-level':176C 'name':143C 'packag':26B 'paramet':95C,122C,161C 'parameteris':164C 'parameterised-queri':163C 'part':39B 'plugin':5A,35B,83C 'possibl':170C 'post':98C 'prepar':127C,155C 'protect':166C 'provid':47B,94C,140C 'queri':43B,132C,165C,186C,192C 'rather':156C 'rest':9A,51B,101C 'sensit':70B,199C 'shipment':3A,20A,24B,31B,79C,136C 'shop':59B,175C 'site':74B 'slug':141C 'sql':6A,67B,89C,131C,185C 'string':152C 'suffici':126C 'suppli':121C 'track':4A,25B,32B,46B,80C,93C,137C 'tracking':21A 'use':196C 'user':120C 'user-suppli':119C 'valu':145C 'version':105C 'via':8A,91C 'vulner':87C 'wc':134C 'without':53B 'woo':18A 'woo-advanced-shipment-tracking':17A 'woocommerc':2A,27B,34B,82C 'wordpress':1A,28B,37B,85C 'wpdb':154C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Advanced Shipment Tracking for WooCommerce plugin at version 3.9 or earlier are exposed. Exploitation requires an account with Shop Manager access or higher, so stores that restrict those roles to trusted staff have lower exposure. Sites that do not run this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wooadvancedshipmenttracking"],"ptokens":["advanced","shipment","tracking","woo"],"labels":["advancedshipmenttracking","high","package","woocommerce","wordpress"],"first_public_at":"2026-11-03T05:18:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120558","severity":null,"published_at":"2026-11-03T05:18:33+00:00","modified_at":"2026-11-03T05:18:33+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120558:1457","url":null,"severity":null,"published_at":"2026-11-03T05:50:51+00:00","modified_at":"2026-11-03T05:50:51+00:00","first_seen_at":"2026-11-03T05:50:51+00:00","fetched_at":"2026-11-03T05:50:51+00:00","note":"NVD/Wordfence: <=3.9 affected, Shop Manager+ SQLi. WordSec (third-party) says patched in 3.9.1. Zorem's changelog has a 3.9.1 'Security - fixed a vulnerability reported via Patchstack' entry that does not name this issue, so fix is not marked verified. 4.0.1 fixes a separate CVE-2026-57773. No exploitation or PoC found. X not checked."}],"documents":[{"id":55848,"url":"https://github.com/zorem/woo-advanced-shipment-tracking","title":"zorem/woo-advanced-shipment-tracking readme and changelog","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":55849,"url":"https://wordsec.net/vulnerabilities/plugins/woo-advanced-shipment-tracking/advanced-shipment-tracking-for-woocommerce-39-authenticated-shop-manager-sql-injection-via-tracking_provider-parameter","title":"WordSec: AST <= 3.9 SQL Injection (patched in 3.9.1)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}