Arbitrary Options Update Vulnerability in Advanced Shipment Tracking for WooCommerce by WordPress

CVE-2021-4347

What is CVE-2021-4347?

The Advanced Shipment Tracking plugin for WooCommerce contains a vulnerability that allows authenticated users, including customers, to update any option in the WordPress database. This issue is present in versions up to 3.2.6 and poses a serious security risk, as it enables attackers to manipulate site settings without proper authorization. Although version 3.2.5 was introduced as a fix, it does not adequately resolve the vulnerability. Users are urged to upgrade to the latest version to mitigate these risks.

References