Executive brief
A vulnerability in the bpost shipping plugin for WordPress allows unauthorized individuals to interfere with the website's database. By submitting a specially crafted order through the WooCommerce checkout process, an attacker can extract sensitive information or disrupt store operations. This could lead to the theft of customer data or administrative credentials, potentially compromising the entire online store.
Technical details
The bpost-shipping-platform plugin for WordPress fails to properly sanitize the 'shipping_pickup_id' parameter before incorporating it into a SQL query during the WooCommerce checkout process. Specifically, the input is only processed via 'sanitize_text_field()', which does not prevent escaping from double-quoted SQL strings. An unauthenticated attacker can exploit this by submitting a crafted POST request to the 'wc-ajax=checkout' endpoint with a malicious payload. This allows for time-based blind SQL injection, enabling the extraction of sensitive data from the database. The vulnerability is fixed in version 3.2.3.
Affected products
- bpost bpost-shipping-platform < 3.2.3
Timeline
- 2026-06-30: disclosed: Initial public disclosure by researcher
- 2026-07-21: advisory: NVD publication date
- 2026-07-21: patched: Plugin updated to version 3.2.3 to address the issue