Zorem
Monthly
SQL injection in the Advanced Shipment Tracking for WooCommerce plugin (all versions up to and including 3.9) allows an authenticated user with Shop Manager-level access or higher to inject SQL through the tracking_provider parameter of the POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings REST route, letting them append additional queries to an existing statement and read data from the WordPress database. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); integrity and availability effects are not established by the available evidence, and the practical barrier is the Shop Manager privilege requirement rather than any exotic configuration. No public exploit code has been identified at time of analysis, and there is no KEV or other active-exploitation signal in the supplied intelligence.
Blind SQL injection in the Zorem "Advanced Shipment Tracking for WooCommerce" WordPress plugin (all versions through 4.0) lets an authenticated high-privileged user inject SQL into a backend query and extract database contents inference by inference. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via Patchstack. Because exploitation requires elevated WordPress privileges (CVSS PR:H), real-world risk is bounded to trusted-but-abusive or compromised admin/shop-manager accounts rather than anonymous internet attackers.
Authentication bypass in the Customer Email Verification for WooCommerce plugin (all versions up to and including 2.8.2) allows unauthenticated front-end visitors to complete the plugin's email-verification step for an arbitrary address, letting them log in as a newly created verified WooCommerce customer or flip an existing account's customer_email_verified meta to verified. The bypass relies on three weaknesses chained together: the cusomer_email_verify handler performs no capability or nonce check, the secret_code it validates is generated as md5(email . time()), and the verify_otp_nonce needed to trigger token issuance is disclosed to every visitor through wp_localize_script. Severity is constrained rather than urgent: CVSS 3.1 base 4.8 (AC:H) and the trigger only works on sites where the cev_user_log table retains a password column from an older schema, which clean 2.8.2 installs do not have; no CISA KEV entry and no public exploit code were identified at time of analysis, and impact is limited to customer-level accounts rather than administrative takeover.
Missing Authorization vulnerability in zorem Advanced Local Pickup for WooCommerce.6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.5.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the Advanced Shipment Tracking for WooCommerce plugin (all versions up to and including 3.9) allows an authenticated user with Shop Manager-level access or higher to inject SQL through the tracking_provider parameter of the POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings REST route, letting them append additional queries to an existing statement and read data from the WordPress database. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); integrity and availability effects are not established by the available evidence, and the practical barrier is the Shop Manager privilege requirement rather than any exotic configuration. No public exploit code has been identified at time of analysis, and there is no KEV or other active-exploitation signal in the supplied intelligence.
Blind SQL injection in the Zorem "Advanced Shipment Tracking for WooCommerce" WordPress plugin (all versions through 4.0) lets an authenticated high-privileged user inject SQL into a backend query and extract database contents inference by inference. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed via Patchstack. Because exploitation requires elevated WordPress privileges (CVSS PR:H), real-world risk is bounded to trusted-but-abusive or compromised admin/shop-manager accounts rather than anonymous internet attackers.
Authentication bypass in the Customer Email Verification for WooCommerce plugin (all versions up to and including 2.8.2) allows unauthenticated front-end visitors to complete the plugin's email-verification step for an arbitrary address, letting them log in as a newly created verified WooCommerce customer or flip an existing account's customer_email_verified meta to verified. The bypass relies on three weaknesses chained together: the cusomer_email_verify handler performs no capability or nonce check, the secret_code it validates is generated as md5(email . time()), and the verify_otp_nonce needed to trigger token issuance is disclosed to every visitor through wp_localize_script. Severity is constrained rather than urgent: CVSS 3.1 base 4.8 (AC:H) and the trigger only works on sites where the cev_user_log table retains a password column from an older schema, which clean 2.8.2 installs do not have; no CISA KEV entry and no public exploit code were identified at time of analysis, and impact is limited to customer-level accounts rather than administrative takeover.
Missing Authorization vulnerability in zorem Advanced Local Pickup for WooCommerce.6.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.5.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including, 1.5.5 due to insufficient escaping on. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.