CVE-2026-54815: WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability

Synopsis

A SQL injection vulnerability exists in the Cargo Shipping Location for WooCommerce WordPress plugin at version 5.6 and below. The flaw is reachable over the network without any authentication, derived from the CVSS vector showing AV:N and PR:N. Successful exploitation allows blind SQL injection, giving an attacker the ability to read confidential data from the underlying database, with a scope change that means impact extends beyond the plugin itself to the broader WordPress and WooCommerce database. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress service over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or session credential of any kind is needed to trigger the injection point.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or environmental factors must be satisfied.

Blast Radius

• Reads arbitrary rows from the WordPress and WooCommerce database, including stored customer records, order histories, and account credentials.
• Because the CVSS scope is changed (S:C), the confidentiality impact extends beyond the plugin's own data boundary to any table the database user can access.
• Causes limited disruption to database availability, consistent with the Low availability impact token in the CVSS vector.
• An attacker using blind SQL injection techniques can systematically extract data over repeated requests without triggering obvious application errors.