Fast Courier WordPress plugin: Unauthenticated SQL injection via REST route
Summary
The Fast Courier shipping plugin for WordPress does not sanitize a value before using it in an SQL query on an unauthenticated REST route. An unauthenticated remote attacker can inject SQL and read arbitrary data from the WordPress database, such as customer, order or user data. No login or user interaction is required, and the flaw is reachable on any internet-facing site running a vulnerable version.
Affected
- Fast Courier WordPress plugin (fast-courier-shipping-freight), versions 5.0.0 to before 5.2.4, according to WPScan
- VulDB describes the range as up to 5.2.3, which is the same scope
- Versions before 5.0.0 are not listed as affected; this could not be confirmed further
Fixed in
- Version 5.2.4 (according to WPScan and VulDB; not verified against the vendor changelog)
Workaround
- No workaround is documented in the sources, because a fixed version exists
- Interim measure until 5.2.4 is installed (not from a source): deactivate the plugin if it is not needed
- Interim measure (not from a source): restrict public access to the plugin's REST routes at the web application firewall or reverse proxy
Exploitation
- VulDB marks the issue as a 0-day and reports no available exploit at the time of its entry
- No reports of in-the-wild exploitation were found
- Not listed in the CISA KEV catalog; CISA SSVC lists exploitation as none and automatable as yes
- EPSS values differ between sources (0.00345 and 0.21%), both low
Our recommendation
- Identify any WordPress site running the Fast Courier plugin (WordPress admin under Plugins, or a file scan of wp-content/plugins)
- Update the plugin to 5.2.4 or later, or deactivate it if it is not needed
- Review web server logs for requests to the plugin's REST routes
- If a vulnerable version was reachable, treat the database as potentially exposed and rotate credentials where warranted
- Confirm that 5.2.4 also addresses the related CVE-2026-89289 (missing authorization in the same plugin)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- VulDB entry 419314 vuldb.com
- Vulners CVE/CNA mirror vulners.com
- Vulners VulnRichment vulners.com
- OffSeq radar radar.offseq.com
- ThreatInt CVE record cve.threatint.com
- GitHub issue with EPSS and KEV data github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:13.
Original description (NVD)
The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.