Advanced Shipment Tracking EUVD-2026-43393

Exploitation requires an authenticated WordPress account with high privileges (CVSS PR:H - in practice an administrator or shop-manager role on the WooCommerce site), and access to the plugin functionality/endpoint that constructs the vulnerable SQL query in Advanced Shipment Tracking for WooCommerce version 4.0 or earlier. No end-user interaction is required (UI:N) and the attack is over the network (AV:N) to the WordPress admin surface. The primary limiting factor is the privilege requirement: an anonymous or low-privilege visitor cannot trigger it, so realistic risk is confined to malicious insiders, over-provisioned staff accounts, or attackers who have already obtained privileged credentials/sessions; it is a blind injection, so data extraction is inference-based and slower than in-band SQLi.

The CVSS 3.1 base score is 7.6 (High) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. The single most important signal is PR:H: exploitation requires an already-authenticated, high-privilege account, which sharply narrows the realistic attacker population to insiders or attackers who have already compromised a privileged session, undercutting the "network" reach implied by AV:N. No EPSS score and no SSVC decision data were provided, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC was referenced, so this is not a widespread-scan priority. The scope-change (S:C) and C:H rating reflect that a successful injection can read data across the whole database beyond the plugin's own tables. Net assessment: a genuine High-severity data-disclosure bug, but a moderate operational priority - patch on a normal cycle unless untrusted users hold shop-manager/admin roles, in which case treat it as urgent. Note one caveat to verify: the published I:N/A:L rating is unusually narrow for SQL injection, which often permits data modification; confirm the exact injectable sink with the Patchstack advisory before assuming write access is impossible.

An attacker who already holds a WordPress shop-manager or administrator account - or who has hijacked such a session via phishing or a compromised credential - submits crafted input to a plugin parameter that feeds an unsanitized SQL query. By observing conditional true/false or timing differences in the plugin's responses, they iteratively extract customer PII, order data, and password hashes from the WooCommerce database. No public POC was referenced, so an attacker would need to develop the injection payload against the specific vulnerable endpoint.