Description
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
Published: 2026-10-29
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A PHP Object Injection flaw in the WPCargo Track & Trace plugin allows malicious users to craft a serialized payload that is unserialized by the plugin without proper validation. This flaw can lead to arbitrary code execution on the host server, compromising the confidentiality, integrity, and availability of the entire WordPress installation.

Affected Systems

The vulnerability affects the Arni Cinco WPCargo Track & Trace plugin for WordPress, versions 8.0.5 and earlier. Users running any of these affected releases are at risk.

Risk and Exploitability

The CVSS score of 7.2 indicates a high severity threat. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote, via crafted HTTP requests that supply an unserialized object to the plugin. An attacker with network access to the affected WordPress site could exploit the flaw to run arbitrary PHP code on the server.

Generated by OpenCVE AI on October 29, 2026 at 16:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade WPCargo Track & Trace to the latest version (8.0.6 or newer) to eliminate the object injection flaw.
  • If an upgrade cannot be performed immediately, disable the affected plugin or block the argument that triggers object deserialization until the fix is applied.
  • Audit the WordPress installation to ensure that PHP's unserialize() function is not used insecurely elsewhere and that only required serialization functionality is kept enabled.

Generated by OpenCVE AI on October 29, 2026 at 16:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
Title WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-29T15:24:28.267Z

Reserved: 2026-10-27T00:20:51.130Z

Link: CVE-2026-116864

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-29T16:18:01.090

Modified: 2026-10-29T16:20:19.663

Link: CVE-2026-116864

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T17:00:15Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data