CVE-2026-57773

HighCVSS 7.6

Published: 13/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

32th percentile - higher than 32% of all known CVEs

Summary

The Advanced Shipment Tracking plugin for WooCommerce (versions up to 4.0) is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker can exploit this flaw to execute unauthorized database queries.

Risk Assessment

The risk involves potential theft or modification of data in the WordPress database, including customer and order information, leading to confidentiality and integrity breaches.

Recommendation

Immediately update the Advanced Shipment Tracking for WooCommerce plugin to version 4.1 or later, which includes a fix for the SQL injection vulnerability.

Other vulnerabilities in Advanced Shipment Tracking for WooCommerce

CVE-2026-120558High
The Advanced Shipment Tracking for WooCommerce plugin is vulnerable to SQL Injection via the tracking_provider parameter of the POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings REST endpoint in all versions up to, and including, 3.9. The value is concatenated directly into the format string of $wpdb->prepare() rather than bound as a parameter.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-advanced-shipment-tracking allows Blind SQL Injection.This issue affects Advanced Shipment Tracking for WooCommerce: from n/a through <= 4.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS