CVE-2026-54815

{
  "id": "CVE-2026-54815",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-17T14:17:59.390",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection.\n\nThis issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando SQL (’Inyección SQL’) en Cargo RD Cargo Shipping Location para WooCommerce permite inyección SQL ciega.\n\nEste problema afecta a Cargo Shipping Location para WooCommerce: desde n/a hasta 5.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Cargo RD",
          "product": "Cargo Shipping Location for WooCommerce",
          "defaultStatus": "unaffected",
          "collectionURL": "https://wordpress.org/plugins",
          "packageName": "cargo-shipping-location-for-woocommerce",
          "versions": [
            {
              "version": "n/a",
              "lessThanOrEqual": "5.6",
              "versionType": "custom",
              "status": "affected",
              "changes": [
                {
                  "at": "5.7",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-17T14:51:19.215637Z",
          "id": "CVE-2026-54815",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://patchstack.com/database/wordpress/plugin/cargo-shipping-location-for-woocommerce/vulnerability/wordpress-cargo-shipping-location-for-woocommerce-plugin-5-6-sql-injection-vulnerability?_s_id=cve",
      "source": "[email protected]"
    }
  ]
}