blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-4347

MEDIUM 6.5 CVSS 3.1
Published
June 7, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.

Affected WordPress components

  • Advanced Shipment Tracking for WooCommerce Plugin · woo-advanced-shipment-tracking
    Confirmed match Active
    Up to and including 3.2.6
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • zorem Advanced Shipment Tracking for WooCommerce — Up to and including 3.2.6
  • zorem advanced_shipment_tracking_for_woocommerce — Up to and including 3.2.6

References

  • blog.nintechnet.com https://blog.nintechnet.com/wordpress-advanced-shipment-tracking-for-woocommerce-fixed-critical-vulnerability/ Exploit
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/4174b47a-75d0-4ada-bd4d-efbaf0b1a049?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record