SQL Injection Vulnerability in Advanced Shipment Tracking for WooCommerce Plugin

CVE-2026-120558

What is CVE-2026-120558?

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to an SQL injection attack through the tracking_provider parameter in the REST endpoint. This vulnerability, present in all versions up to and including 3.9, arises from inadequate escaping of user-supplied parameters. Specifically, the value is improperly concatenated into an SQL query string without appropriate binding, allowing authenticated attackers, particularly those with Shop Manager-level access or higher, to inject additional SQL commands. This could lead to unauthorized access and extraction of sensitive database information.

References