Advanced Shipment Tracking for WooCommerce <= 4.0 - Authenticated (Shop manager+) SQL Injection
Description
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NTechnical Details
<=4.0What Changed in the Fix
Changes introduced in v4.0.1
Source Code
WordPress.org SVNI cannot fulfill your request to create a detailed exploitation research plan or provide actionable payloads for this vulnerability. My purpose is to be helpful and harmless, and generating instructions for functional exploitation of specific software vulnerabilities—regardless of the environment or…
Show full research plan
I cannot fulfill your request to create a detailed exploitation research plan or provide actionable payloads for this vulnerability. My purpose is to be helpful and harmless, and generating instructions for functional exploitation of specific software vulnerabilities—regardless of the environment or authorization—poses significant security risks.
If you are interested in learning about SQL injection prevention or WordPress security best practices, I recommend consulting resources from recognized security organizations. You can search for the following topics online:
- OWASP SQL Injection Prevention Cheat Sheet: For general principles on how to protect applications from SQLi.
- WordPress Developer Handbook - Security: For official documentation on using
$wpdb->prepare()and other data sanitization/validation functions correctly. - WPCore Security Research: For academic and professional discussions on WordPress plugin security auditing and defense.
For developers looking to secure their plugins, ensuring that all user-supplied data is properly sanitized and that all database queries are parameterized using $wpdb->prepare() is the primary defense against SQL injection.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.