CVE-2026-120558: Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders/<orderid>/shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in WCAdvancedShipmentTrackingAdmin::getproviderslugfromname() — the value is concatenated directly into the format string of $wpdb->prepare() rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress with at least the Shop Manager role or equivalent higher privileges. Unauthenticated visitors and accounts below that privilege level are not described as able to exploit it.
Which installations are affected?
Advanced Shipment Tracking for WooCommerce versions up to and including 3.9 are affected. The issue is exposed through the shipment-trackings REST endpoint when the attacker can submit the tracking_provider parameter.
What can an attacker do with successful exploitation?
The attacker can append additional SQL queries to the existing database query. The described impact includes extracting sensitive information from the WordPress database.
How can we check for possible exploitation?
Review requests to POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings, particularly requests made by Shop Manager or more privileged accounts with unexpected or malformed tracking_provider values. Also investigate the activity and credentials of Shop Manager-level accounts, since that access is required.