The vulnerability CVE-2026-57773 in Zorem Advanced Shipment Tracking for WooCommerce arises from improper neutralization of special elements used in SQL commands, enabling blind SQL injection attacks. This allows an attacker with high privileges to execute crafted SQL queries that can compromise confidentiality (high impact on confidentiality), with no impact on integrity but limited impact on availability. The affected versions include all versions up to and including 4.0. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (confidentiality impact is high). The vulnerability does not affect data integrity but may cause limited availability impact. The attack requires network access and high privileges, and no user interaction is needed. This could allow attackers to extract sensitive data from the backend database via blind SQL injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin functionality to trusted users only and monitor for unusual database activity. Avoid exposing the vulnerable plugin to untrusted networks or users with high privileges.