Advanced Shipment Tracking for WooCommerce: SQL injection (CVE-2026-120558)

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL injection in versions up to and including 3.9. The vulnerability exists within the WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name() method, where the tracking_provider parameter is improperly concatenated into a SQL query processed by $wpdb->prepare(). Authenticated users with Shop Manager privileges or higher can leverage this to execute unauthorized SQL queries and extract sensitive information from the database.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized database operations, potentially leading to the exfiltration of sensitive information contained within the WordPress database.

Recommendation

• Update Advanced Shipment Tracking for WooCommerce to the version containing the security patch (expected to be > 3.9).
• Review Shop Manager role assignments and audit current plugin users for unauthorized account activity.
• Monitor REST API traffic targeting /wp-json/wc-ast/v3/orders/ for anomalous POST requests containing SQL syntax or characters commonly used in injection attacks.