CVE-2026-54815

CriticalCVSS 9.3/10Last modified Oct 26, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection.

This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Cargo RD	Cargo Shipping Location for WooCommerce	<= 5.6

References

https://patchstack.com/database/wordpress/plugin/cargo-shipping-location-for-woocommerce/vulnerability/wordpress-cargo-shipping-location-for-woocommerce-plugin-5-6-sql-injection-vulnerability?_s_id=cve

Timeline

Published: Jun 17, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-548167.5Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This iss CVE-2026-548176.5Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. Thi CVE-2026-548188.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows B CVE-2026-548199.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL CVE-2026-54829.3Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php e CVE-2026-548209.3Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.CVE-2026-548217.4Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.CVE-2026-548228.5Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.CVE-2026-548239.9Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.CVE-2026-548247.5Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.CVE-2026-548259.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS wpDataTables wpdatatables allows B CVE-2026-548267.6Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.