bpost Shipping Platform EUVD-2026-46158

Exploitation requires that the target WordPress site runs WooCommerce with the bpost Shipping Platform plugin (version < 3.2.3) installed and active, and that the attacker reaches the WooCommerce order-submission/checkout flow where the unsanitized parameter is processed - this is the exact trigger named in the description. No authentication, privileges, or user interaction are needed (PR:N/UI:N), so any anonymous visitor can attempt it against a default-configured vulnerable store. The primary limiting factor is deployment: only stores that have specifically installed the bpost carrier integration are exploitable, which sharply narrows the population of targets relative to generic WooCommerce sites.

The CVSS 3.1 base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - network reachable, low complexity, no privileges, no user interaction, and high confidentiality impact with no integrity or availability impact, consistent with data-exfiltration-focused blind SQLi. Publicly available exploit code (WPScan) raises practical risk above raw score, and unauthenticated exploitability against a standard checkout path means it is automatable with commodity tooling such as sqlmap. Countervailing factors: this is not listed in CISA KEV (no confirmed active exploitation), and the affected plugin is a niche, region-specific WooCommerce add-on, so real-world attack surface is far smaller than a ubiquitous plugin - likely opportunistic scanning rather than mass targeting. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: a genuine, actionable priority for the specific stores that run this plugin, but lower fleet-wide urgency than the 7.5 alone might suggest given limited deployment footprint.

An attacker browses to a WooCommerce store running the bpost plugin, submits an order (or replays the order-submission request) with a crafted value in the vulnerable parameter, and uses time-based payloads to make the database pause on true/false conditions. By automating this with sqlmap against the public checkout endpoint - no login required - they iteratively extract customer PII, order data, and WordPress admin password hashes; publicly available exploit code from WPScan lowers the skill barrier.