CVE-2026-120558 in Advanced Shipment Tracking for WooCommerce Plugin
Summary
by MITRE • 11/03/2026
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The Advanced Shipment Tracking plugin for WooCommerce presents a critical security vulnerability affecting all versions up to and including 3.9. This flaw is classified as an Unrestricted Upload of Functionality with Wrong Path or SQL Injection, specifically falling under CWE-89 Improper Neutralization of Special Elements used in an SQL Command. The vulnerability resides within the REST API endpoint located at POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings, which is utilized to manage shipment tracking information for WooCommerce orders. While the plugin provides legitimate functionality for shop managers and administrators to track shipments, it fails to adequately sanitize user-supplied input before processing database queries, creating a significant attack vector for malicious actors with authenticated access.
The technical root cause of this vulnerability lies in the function WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name(). Within this method, the tracking_provider parameter is concatenated directly into the format string passed to WordPress's $wpdb->prepare() function rather than being bound as a secure parameter. Although $wpdb->prepare() is designed to prevent SQL injection by escaping values and preparing statements, its protective mechanism relies on correct usage where variables are placed in placeholders within the query string. By concatenating user input directly into the format string itself, the application bypasses these built-in safeguards. This implementation error allows an attacker to inject arbitrary SQL syntax that will be executed alongside the legitimate database operation, effectively neutralizing the intended security controls of the WordPress database abstraction layer.
The operational impact of this vulnerability is severe due to its potential for data exfiltration and system compromise. An authenticated attacker with Shop Manager-level access or higher can exploit this flaw by manipulating the tracking_provider parameter in their API requests. By appending malicious SQL code, such as UNION SELECT statements, the attacker can extract sensitive information from the WordPress database. This includes user credentials, personal customer data stored within order details, and potentially administrative configuration settings that could facilitate further attacks. The ability to read arbitrary database content undermines the confidentiality of the entire e-commerce platform, exposing businesses to regulatory penalties under frameworks like GDPR or CCPA due to the leakage of personally identifiable information.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter if used in conjunction with other exploits, but more directly maps to T1213 Data from Information Repositories when focusing on the data extraction aspect. The attack vector requires authentication, which classifies it as an insider threat or a compromised account scenario rather than a remote unauthenticated exploit. However, given that Shop Manager is a relatively common role assigned to multiple staff members in e-commerce environments, the likelihood of credential compromise through phishing or other means remains significant. Once authenticated access is obtained, the exploitation process is straightforward and does not require complex payload construction beyond standard SQL injection syntax tailored for MySQL databases commonly used with WordPress installations.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary defense is to update the Advanced Shipment Tracking plugin to a version newer than 3.9, where this vulnerability has been patched by properly binding parameters instead of concatenating them into query strings. For organizations unable to patch immediately due to compatibility constraints with other plugins or custom code modifications, temporary mitigation involves restricting access to the WordPress admin area and REST API endpoints using IP whitelisting or two-factor authentication for all user accounts possessing Shop Manager privileges or higher. Additionally, implementing a Web Application Firewall can help detect and block common SQL injection patterns in POST requests targeting WooCommerce REST APIs, although this is not a substitute for fixing the underlying code flaw. Regular security audits of custom plugin development practices are also recommended to ensure that future integrations adhere to secure coding standards regarding database interaction and input validation.