Advanced Shipment Tracking CVE-2026-120558

Requires an authenticated account with Shop Manager-level privileges or higher (per CVSS PR:H); the attacker then calls the plugin's REST route POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings and supplies a malicious tracking_provider parameter, which reaches the vulnerable WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name() query where the value is concatenated into the $wpdb->prepare() format string instead of being bound. Affects all versions up to and including 3.9. The primary limiting factor is the Shop Manager privilege requirement - anonymous or low-privileged users cannot reach this; no non-default configuration is stated as necessary.

This is a genuine but privilege-gated SQL injection (CWE-89). The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) and the description agree internally: exploitation is network-reachable over the REST API with low complexity and no user interaction, but requires PR:H - explicitly Shop Manager-level access or above. That high-privilege precondition is the dominant risk-limiter, since Shop Managers are trusted store operators, not anonymous internet users, so this is primarily an insider/compromised-account or privilege-boundary concern rather than a mass-exploitable perimeter flaw. No EPSS score, KEV listing, or exploit/PoC reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a serious-but-not-emergency issue. Net: patch within the normal cycle (this week) - it is a legitimate priority because the root cause (direct concatenation into the $wpdb->prepare() format string) gives a trusted-but-not-admin role full read access to the WordPress database, but the PR:H barrier keeps real-world blast radius well below that of an unauthenticated SQLi.

An attacker who already holds (or has phished/compromised) a Shop Manager account sends a crafted POST request to /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings with a malicious tracking_provider value, which is concatenated into an unsafe SQL query and lets them append queries that read arbitrary data (e.g., user records, password hashes, secrets) from the WordPress database. The attack is low-complexity and needs no user interaction, but is bounded by the requirement for Shop Manager privileges. No public exploit code is identified at time of analysis.