Security report: possible SQL injection | WordPress.org

tonyh310
(@tonyh310)

2 weeks, 1 day ago

Hello,

I’m using Advanced Shipment Tracking for WooCommerce (version 4.0).

The iThemes/Solid Security Site Scanner has flagged a potential SQL injection vulnerability affecting versions ≤ 4.0 (reported today via Patchstack data).

Viewing 2 replies - 1 through 2 (of 2 total)

ProActive
(@sholly2)

2 weeks, 1 day ago

PatchStack – https://patchstack.com/database/wordpress/plugin/woo-advanced-shipment-tracking/vulnerability/wordpress-advanced-shipment-tracking-for-woocommerce-plugin-4-0-sql-injection-vulnerability

CVE ID: CVE-2026-57773

WordPress Advanced Shipment Tracking for WooCommerce Plugin <= 4.0 is vulnerable to SQL Injection

This security issue has a low severity impact and is unlikely to be exploited.

Plugin Author gaurav1092
(@gaurav1092)

2 weeks ago

Hi @tonyh310, @sholly2

Thanks for the heads-up and for the detailed report — we appreciate you flagging it.

We’re already on it: we’ll be releasing an updated version with the fix by next Tuesday. As the Patchstack entry notes, it’s rated low severity and unlikely to be exploited, so there’s no immediate risk in the meantime, but we’re addressing it promptly to be safe.

I’ll let you know once the patched version is released so you can update. Thanks again for bringing it to our attention.

Best Regards,
Gaurav

Viewing 2 replies - 1 through 2 (of 2 total)

You must be logged in to reply to this topic.

3 replies
3 participants
Last reply from: gaurav1092
Last activity: 2 weeks ago
Status: not resolved