CVE-2026-52700: WordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerability

Synopsis

SQL injection vulnerability in the WCMultiShipping WordPress plugin (versions 3.0.2 and below) allows an authenticated attacker with only subscriber-level access to send malicious database queries over the network. No elevated privileges are needed beyond a basic account, making exploitation accessible to any registered user. Successful exploitation gives the attacker read access to sensitive database contents across the WooCommerce site and causes minor availability disruption. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress service via HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege account (subscriber level) is sufficient; no administrative or elevated role is needed.

• Victim interactionNot required

  The attacker sends the malicious request directly with no need for any user to click a link or take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental factors required.

Blast Radius

• The attacker can read arbitrary rows from the WordPress and WooCommerce database, including stored order records, customer PII, and hashed credentials.
• Session tokens, API keys, or payment-related metadata stored in the database may be extracted directly.
• The availability impact is rated low, meaning the attacker can cause minor or intermittent disruption to database-dependent site functions.