EUVD-2026-43393Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
Requires an authenticated high-privilege WordPress account (PR:H) over the network with no user interaction; blind SQLi enables full DB read (C:H) but no confirmed write or availability impact, and I keep scope unchanged (S:U) as the injection stays within the app's own DB.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through <= 4.0.
Articles & Coverage 1
AnalysisAI
Blind SQL injection in the Zorem "Advanced Shipment Tracking for WooCommerce" WordPress plugin (all versions through 4.0) lets an authenticated high-privileged user inject SQL into a backend query and extract database contents inference by inference. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via Patchstack. Because exploitation requires elevated WordPress privileges (CVSS PR:H), real-world risk is bounded to trusted-but-abusive or compromised admin/shop-manager accounts rather than anonymous internet attackers.
Technical ContextAI
The affected component is a WooCommerce add-on plugin (CPE cpe:2.3:a:zorem:advanced_shipment_tracking_for_woocommerce) that manages shipment tracking numbers, carriers, and order status inside WordPress/WooCommerce. The root cause is CWE-89, Improper Neutralization of Special Elements in an SQL Command: user-controllable input reaches a SQL statement without proper parameterization or escaping, so attacker-supplied special characters alter the query structure. This is the "blind" variant, meaning results are not returned directly in the response; the attacker infers data by observing boolean/behavioral or timing differences in the application, which is slower but still allows full read of the WordPress/WooCommerce database (orders, users, password hashes, secrets).
RemediationAI
No vendor-released patched version is identified in the provided data - the advisory only records the vulnerable range as "through <= 4.0" without naming a fixed release - so consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/woo-advanced-shipment-tracking/vulnerability/wordpress-advanced-shipment-tracking-for-woocommerce-plugin-4-0-sql-injection-vulnerability) and the plugin's WordPress.org changelog for a version newer than 4.0 and update to it once released. Until a fixed version is confirmed, apply compensating controls: tightly restrict which accounts hold administrator/shop-manager roles and audit existing privileged users, since exploitation depends on a high-privilege account (trade-off: operational friction for staff); deploy a WordPress-aware WAF or Patchstack's virtual patch to block SQL-injection payloads against the plugin's endpoints (trade-off: possible false positives on legitimate order/tracking input); and enforce least-privilege on the WordPress database user so the web app cannot reach unrelated schemas (trade-off: may break other plugins that assume broad DB access). Enable query logging to detect anomalous inference-style queries.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today