What is the CVSS score of EUVD-2026-46158?

EUVD-2026-46158 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of bpost Shipping Platform are affected by EUVD-2026-46158?

The bpost Shipping Platform WordPress plugin (versions before 3.2.3) contains a critical SQL injection vulnerability in WooCommerce checkout that enables unauthenticated attackers to extract…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-46158?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46158. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-46158?

Within 24 hours, identify and audit all WooCommerce stores using the bpost Shipping Platform plugin to prioritize patching. Within 7 days, upgrade the plugin to version 3.2.3 or later across all affected installations and validate successful deployment. Within 30 days, review database access logs for SQL injection attack patterns and unauthorized data extraction attempts to determine if the vulnerability was exploited prior to patching.

bpost Shipping Platform EUVD-2026-46158

| CVE-2026-8082 HIGH

SQL Injection (CWE-89)

2026-07-21 WPScan

GHSA-3gcj-q53g-wp8x

WordPress SQLi Bpost Shipping Platform

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable checkout parameter (PR:N/UI:N/AV:N), automatable time-based blind SQLi (AC:L); blind read enables data disclosure (C:H) with no write or DoS primitive (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 14:23 vuln.today

CVSS changed

Jul 21, 2026 - 14:22 NVD

7.5 (HIGH)

Patch available

Jul 21, 2026 - 08:02 EUVD

CVE Published

Jul 21, 2026 - 06:00 cve.org

HIGH 7.5

CVE Published

Jul 21, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.

AnalysisAI

SQL injection in the bpost Shipping Platform WordPress plugin (versions before 3.2.3) lets unauthenticated attackers inject SQL via an unsanitized parameter processed during WooCommerce order submission, enabling time-based blind extraction of database contents. Any WooCommerce store using this Belgian-postal shipping integration is exposed at checkout without authentication or user interaction. Publicly available exploit code exists (WPScan) and a vendor patch is available, though there is no public exploit identified as being actively used in the wild (not in CISA KEV).

Technical ContextAI

The affected component is a WooCommerce shipping-integration plugin (cpe:2.3:a:unknown:bpost-shipping-platform) that connects WordPress/WooCommerce checkout to Belgium's bpost carrier service. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a user-controlled parameter submitted as part of the order/checkout flow is concatenated into a SQL query without parameterization or sanitization. Because the injection is exercised on the WooCommerce order-submission path - a public, unauthenticated endpoint - the plugin's database queries can be manipulated by any store visitor. The vulnerability manifests as time-based blind SQLi, meaning results are inferred from server response delays rather than returned directly, which is the classic signature of an injectable parameter with suppressed error/output.

RemediationAI

Vendor-released patch: upgrade the bpost Shipping Platform plugin to version 3.2.3 or later, which is the definitive fix (patch available from vendor per WPScan). Until the upgrade can be applied, compensating controls include placing a Web Application Firewall rule in front of the WooCommerce checkout/order-submission endpoint to detect and block SQL metacharacters and time-based injection patterns (trade-off: WAF signatures for blind SQLi can be bypassed and may cause false positives on legitimate order data), and, if bpost shipping is not actively needed, deactivating the plugin entirely to remove the vulnerable code path (trade-off: bpost shipping options disappear from checkout). Restricting or monitoring the checkout parameter for anomalous input and enabling detailed query logging can aid detection while patching is scheduled. Confirm the fix and review guidance via the WPScan advisory (https://wpscan.com/vulnerability/21b31199-01d5-4c43-8699-eca4bc7e8389/).