Advanced Shipment Tracking for WooCommerce <= 4.0.3 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure via ast_email_preview AJAX Action
- ID
- WPSEC-2026-0119
- Plugin
- Advanced Shipment Tracking for WooCommerce (woo-advanced-shipment-tracking)
- Affected
- from 3.4.5 before 4.0.4
- Remediation
- Update to 4.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Advanced Shipment Tracking for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data in versions 3.4.5 up to, and including, 4.0.3 due to a missing capability check on the get_preview_email() function, which is registered on the wp_ajax_ast_email_preview action. This makes it possible for authenticated attackers, with subscriber-level access and above (including WooCommerce customers), to request the email customizer preview and view the rendered WooCommerce order email for the order the store administrator selected as the preview order, including that customer's name, billing and shipping address, email, phone number and purchased items. When the default mockup order is selected, only placeholder data is exposed.
References
- https://wpsec.com/vuln/WPSEC-2026-0119/
- https://plugins.svn.wordpress.org/woo-advanced-shipment-tracking/tags/4.0.4/
- https://wordpress.org/plugins/woo-advanced-shipment-tracking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS