What is the CVSS score of CVE-2026-54815?

CVE-2026-54815 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of Cargo Shipping Location for WooCommerce are affected by CVE-2026-54815?

The Cargo Shipping Location for WooCommerce plugin (versions ≤5.6) contains a critical blind SQL injection vulnerability enabling unauthenticated remote attackers to extract sensitive data from…

How to fix or mitigate CVE-2026-54815?

24 hours: Audit all WordPress installations for Cargo Shipping Location plugin presence and affected versions (≤5.6); identify business-critical sites and data sensitivity. 7 days: Disable or remove the plugin on all affected sites; implement Web Application Firewall (WAF) rules to block SQL injection patterns on any remaining installations; apply database access controls limiting plugin database permissions. 30 days: Replace with alternative shipping solution or contact vendor regarding patch timeline; validate all database access logs for exploitation attempts during exposure window.

Cargo Shipping Location for WooCommerce CVE-2026-54815

CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wordpress Plugin Cargo Shipping Location For Woocommerce

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.1 CRITICAL

Unauthenticated network-reachable blind SQLi (AV:N/AC:L/PR:N/UI:N) against the WordPress DB normally enables both read and tampering, so C:H/I:H; scope stays Unchanged as impact is confined to the same DB authority.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:24 vuln.today

CVE Published

Jun 17, 2026 - 13:40 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection.

This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.

Articles & Coverage 1

News Critical Blind SQL Injection in WordPress Cargo Shipping Location for WooCommerce - CVE-2026-54815 Jun 18, 2026

AnalysisAI

Blind SQL injection in the Cargo RD 'Cargo Shipping Location for WooCommerce' WordPress plugin (versions up to and including 5.6) allows remote unauthenticated attackers to inject arbitrary SQL via unsanitized input passed to backend database queries. The flaw carries a CVSS 3.1 base score of 9.3 (Critical) due to its network-reachable, no-privilege, no-interaction profile and scope-changed confidentiality impact, and no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-89 Improper Neutralization of Special Elements used in an SQL Command, manifesting as a blind SQLi where the attacker cannot directly observe query results but can infer data through boolean/time-based side channels. The affected component is a WooCommerce-integrated WordPress plugin developed by Cargo RD that manages shipping location data, identified by CPE cpe:2.3:a:cargo_rd:cargo_shipping_location_for_woocommerce. Plugins of this class typically register AJAX or REST endpoints that concatenate user-controlled parameters into MySQL/MariaDB queries against the WordPress wp_ database, exposing core tables such as wp_users (password hashes), wp_options (site secrets), and WooCommerce order tables when sanitization via wpdb->prepare() or esc_sql() is missing.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/cargo-shipping-location-for-woocommerce/vulnerability/wordpress-cargo-shipping-location-for-woocommerce-plugin-5-6-sql-injection-vulnerability) lists the issue against versions up to 5.6 without naming a fixed release, so administrators should monitor the plugin page for an update beyond 5.6 and apply it as soon as released. Until a fix is available, deactivate and remove the Cargo Shipping Location for WooCommerce plugin (trade-off: shipping location calculation features will be lost and checkout flows that depend on them may need a fallback) or place the WordPress site behind a WAF such as Patchstack, Wordfence, or Cloudflare with SQLi rulesets enabled and virtual patching for this CVE turned on (trade-off: WAF bypasses are common for blind SQLi using encoded payloads). As a hardening layer, restrict the WordPress database user's privileges to the minimum required (no FILE, no cross-database SELECT) to limit the blast radius if the endpoint is exploited.