This vulnerability is an Authorization flaw that permits Insecure Direct Object References (IDOR). An attacker can manipulate request parameters to reference objects outside the intended scope, potentially exposing data that should be restricted. The weakness is identified by CWE-862, indicating improper authentication or authorization controls. This flaw can lead to confidentiality violations, allowing an adversary to retrieve or modify data that should be protected from the unauthenticated or improperly authenticated user.

The affected product is WPCargo Track & Trace developed by Arni Cinco. Versions from the beginning up to and including 8.0.2 are impacted. Users who have installed any of these versions of the plugin should verify which release they are running and plan a remediation path.

The CVSS score of 4.3 places this vulnerability in the low to moderate severity range. The EPSS score of less than 1% indicates that exploitation is unlikely but not impossible. It is not listed in the CISA KEV catalog. The likely attack vector is remote, whereby a user with knowledge of the underlying object identifiers crafts requests to access unauthorized resources. There is no requirement for elevated privileges beyond standard user access, which may make the attack relatively easy if the user can observe or guess IDs. However, because the EPSS is very low and the overall severity is moderate, the immediate risk to an organization is limited unless the plugin handles highly sensitive data.