PT-2026-2829 · Unknown+1 · Woocommerce+1

Nguyen Truong · Published 2026-01-14 · Updated 2026-01-14 · CVE-2026-0678

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flat Shipping Rate by City for WooCommerce plugin for WordPress versions up to and including 1.0.3

Description The software is susceptible to a time-based SQL Injection issue through the cities parameter. Insufficient input sanitization and inadequate SQL query preparation allow authenticated attackers with Shop Manager-level access or higher to inject additional SQL queries into existing database queries. This can potentially lead to the extraction of sensitive information from the database.

Recommendations Versions prior to and including 1.0.3 should be updated to a newer, secure version if available. As a temporary workaround, restrict access to the cities parameter.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-0678

Affected Products

Shipping Rates By City For Woocommerce

Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-0678 · Security Note
• https://plugins.trac.wordpress.org/browser/flat-shipping-rate-by-city-for-woocommerce/trunk/shipping-method-class.php#L154 · Note
• https://twitter.com/VulmonFeeds/status/2011393057866789292 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4ada476b-6978-4c38-a5d3-67266a709a3e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/flat-shipping-rate-by-city-for-woocommerce/tags/1.0.3/shipping-method-class.php#L154 · Note
• https://twitter.com/CVEnew/status/2011382994716578267 · Twitter Post