PT-2026-2829 · Unknown+1 · Woocommerce+1

Nguyen Truong · Publicado 2026-01-14 · Atualizado 2026-01-14 · CVE-2026-0678

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flat Shipping Rate by City for WooCommerce plugin for WordPress versions up to and including 1.0.3

Description The software is susceptible to a time-based SQL Injection issue through the cities parameter. Insufficient input sanitization and inadequate SQL query preparation allow authenticated attackers with Shop Manager-level access or higher to inject additional SQL queries into existing database queries. This can potentially lead to the extraction of sensitive information from the database.

Recommendations Versions prior to and including 1.0.3 should be updated to a newer, secure version if available. As a temporary workaround, restrict access to the cities parameter.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-0678

Produtos afetados

Shipping Rates By City For Woocommerce

Woocommerce

Referências · 6

• https://plugins.trac.wordpress.org/browser/flat-shipping-rate-by-city-for-woocommerce/trunk/shipping-method-class.php#L154 · Nota
• https://twitter.com/VulmonFeeds/status/2011393057866789292 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/4ada476b-6978-4c38-a5d3-67266a709a3e?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0678 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/flat-shipping-rate-by-city-for-woocommerce/tags/1.0.3/shipping-method-class.php#L154 · Nota
• https://twitter.com/CVEnew/status/2011382994716578267 · Publicação no Twitter