Description
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
Published: 2026-08-06
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not correctly sanitise a configuration parameter used in a SQL query, allowing unauthenticated users to inject arbitrary SQL statements. The flaw is separate from the issue addressed by CVE‑2024‑44004 and can lead to reading, modifying, or deleting sensitive data stored in the WordPress database, thereby compromising confidentiality and integrity of site content.

Affected Systems

Any WordPress site running the WPCargo Track & Trace plugin with a version older than 8.0.4 is affected. No specific sub‑version range is listed beyond the <8.0.4 cutoff, so the vulnerability applies to all releases prior to 8.0.4.

Risk and Exploitability

Based on the description, it is inferred that an attacker can trigger the vulnerability by sending an HTTP request containing a crafted wpcargo_tracking_number value to the plugin’s tracking endpoint, which requires no authentication. This leads to a high risk of exploitation, as the flaw can expose or alter database contents. The CVSS score of 9.1 indicates a high severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the potential impact remains significant.

Generated by OpenCVE AI on August 6, 2026 at 17:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the WPCargo Track & Trace plugin to version 8.0.4 or later.
  • If updating immediately is not possible, disable the plugin or restrict access to its tracking endpoint to authenticated administrators only.
  • Deploy a web application firewall or configure the web server to detect and block suspicious SQL injection patterns on requests to the plugin’s tracking endpoint.
  • Ensure any custom code that interacts with the plugin does not pass unsanitized input to SQL queries.

Generated by OpenCVE AI on August 6, 2026 at 17:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 07 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Arni Cinco
Arni Cinco wpcargo Track & Trace
Wordpress
Wordpress wordpress
Vendors & Products Arni Cinco
Arni Cinco wpcargo Track & Trace
Wordpress
Wordpress wordpress

Thu, 06 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Description The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
Title WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number
References

Subscriptions

Arni Cinco Wpcargo Track & Trace
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-06T14:39:54.416Z

Reserved: 2026-06-19T10:59:56.092Z

Link: CVE-2026-12713

cve-icon Vulnrichment

Updated: 2026-08-06T14:39:50.369Z

cve-icon NVD

Status : Deferred

Published: 2026-08-06T07:16:26.990

Modified: 2026-08-26T16:31:16.753

Link: CVE-2026-12713

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T09:15:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')