Advanced Shipment Tracking for WooCommerce, 655be98507ab7cd0e9f95a8ae2b65f2942c7da11

CVE, Research URL: 655be98507ab7cd0e9f95a8ae2b65f2942c7da11
Home page URL: Security reports for Advanced Shipment Tracking for WooCommerce
Application: Advanced Shipment Tracking for WooCommerce
Published on: Jul 26, 2021
Research Description: Advanced Shipment Tracking for WooCommerce [woo-advanced-shipment-tracking] < 3.2.7 Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue.
Affected versions: max 3.2.7.
Status: vulnerable