---
id: "CVE-2026-120558"
kind: "vulnerability"
aliases: ["CVE-2026-120558"]
title: "WordPress WooCommerce shipment tracking plugin: SQL injection via REST endpoint"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "woo-advanced-shipment-tracking", "fixed": ["3.9.1"], "affected": "<= 3.9", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["advanced-shipment-tracking", "package", "woocommerce", "wordpress"]
not_affected_if: ["no-shop-manager-accounts", "plugin-above-3.9", "plugin-not-installed"]
published_at: "2026-11-03T05:18:33+00:00"
first_seen_at: "2026-11-03T05:48:53+00:00"
updated_at: "2026-11-03T05:50:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120558", "first_seen_at": "2026-11-03T05:48:53+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T05:50:51+00:00"}]
---

# WordPress WooCommerce shipment tracking plugin: SQL injection via REST endpoint

The Advanced Shipment Tracking for WooCommerce plugin for WordPress builds part of a database query from the tracking_provider field of its REST endpoint without escaping it. An attacker with Shop Manager access or higher can append extra SQL to extract sensitive data from the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:woo-advanced-shipment-tracking affected <= 3.9 fixed 3.9.1

## How to check

- In WordPress admin go to Plugins > Installed Plugins and read the version of Advanced Shipment Tracking for WooCommerce (slug woo-advanced-shipment-tracking). 3.9 or lower is affected; 3.9.1 or later has the fix.
- The vulnerable route is POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings (tracking_provider parameter). Exploitation needs a Shop Manager or higher account, so also review who holds that role.

## Fix

Update Advanced Shipment Tracking for WooCommerce to 3.9.1 or later; the current stable release on GitHub is 4.0.4. Move to 4.0.1 or later, because a separate SQL injection (CVE-2026-57773) affects versions up to 4.0.

## Timeline

- 2026-11-03T05:48:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120558
- 2026-11-03T05:50:51+00:00 analyst — NVD/Wordfence: <=3.9 affected, Shop Manager+ SQLi. WordSec (third-party) says patched in 3.9.1. Zorem's changelog has a 3.9.1 'Security - fixed a vulnerability reported via Patchstack' entry that does not name this issue, so fix is not marked verified. 4.0.1 fixes a separate CVE-2026-57773. No exploitation or PoC found. X not checked.

## Documents

- [describes] WordSec: AST <= 3.9 SQL Injection (patched in 3.9.1) https://wordsec.net/vulnerabilities/plugins/woo-advanced-shipment-tracking/advanced-shipment-tracking-for-woocommerce-39-authenticated-shop-manager-sql-injection-via-tracking_provider-parameter
- [fix] zorem/woo-advanced-shipment-tracking readme and changelog https://github.com/zorem/woo-advanced-shipment-tracking

## From the sources

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_