CVE-2021-4347 | The function update_shipment_status_email_status_fun in the … | CVSS 9.9 CRITICAL

Description

The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.

Metadata

CVE ID: CVE-2021-4347
State: PUBLISHED
Assigner: Wordfence
Reserved: 2023-06-06 12:37 UTC
Published: 2023-06-07 01:51 UTC
Last updated: 2026-04-08 16:48 UTC
Primary CWE: CWE-862
CWE-862 Missing Authorization
Vendor / Product: zorem / Advanced Shipment Tracking for WooCommerce
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
zorem	Advanced Shipment Tracking for WooCommerce	—	0 ≤ 3.2.6

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862 Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

References (2)