CVE-2021-4347
Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change
- State
- Published
- Severity
- 9.9 Critical
- Published
- Jun 7, 2023
- Updated
- Apr 8, 2026
- Reserved
- Jun 6, 2023
Description
The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.9 Critical | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H | Wordfence |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Advanced Shipment Tracking for WooCommercezorem |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.