Vulnerability · Published Jun 7, 2023 · Assigned by Wordfence

CVE-2021-4347Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change

Critical 9.9

In plain English

A critical-severity missing authorization in Advanced Shipment Tracking for WooCommerce from zorem. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.7%top 48.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.

Affected products (as reported)

Vendor	Product	Versions
zorem	Advanced Shipment Tracking for WooCommerce	0 – through 3.2.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

In plain English

Official description

Affected products (as reported)

References