The WPCargo Track & Trace plugin for WordPress contains a missing‑authorization flaw that allows an attacker to bypass the plugin’s access‑control checks. This vulnerability, classified as an Access Control Failure (CWE‑862), can enable unauthorized users to view sensitive cargo and tracking information that should be protected. The plugin’s default configuration permits access to this data without proper credential verification, creating a scenario where the confidentiality of cargo records is at risk.

This issue affects the Arni Cinco WPCargo Track & Trace product, specifically all releases up to and including version 8.0.2. Any WordPress site that has this plugin installed and has not applied the latest update is potentially exposed, regardless of the site’s overall security posture.

The flaw is scored with a CVSS v3.1 base score of 7.5, indicating high severity. The EPSS score is below 1 %, suggesting that exploitation attempts are expected to be infrequent. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description and the nature of the missing authorization check, the likely attack vector is a remote web request to the plugin’s endpoints; this inference is drawn from the mention of incorrectly configured access control security levels.