CVE-2021-4347

CRITICAL

Zorem Advanced Shipment Tracking For Woocommerce < 3.2.6 - Missing Authorization

Title source: rule

Description

The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.

References (2)

Core 2

Core References

Exploit

https://blog.nintechnet.com/wordpress-advanced-shipment-tracking-for-woocommerce-fixed-critical-vulnerability/

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/4174b47a-75d0-4ada-bd4d-efbaf0b1a049?source=cve

Scores

CVSS v3 9.9

EPSS 0.0065

EPSS Percentile 46.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

zorem/Advanced Shipment Tracking for WooCommerce < 3.2.6

zorem/advanced_shipment_tracking_for_woocommerce < 3.2.6

Published Jun 07, 2023

Tracked Since Feb 18, 2026