CVE-2024-44004
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The WPCargo Track & Trace plugin before version 8.0.4 contains an SQL injection vulnerability in the wpcargo module. An attacker can exploit improper neutralization of special elements in an SQL command.
Risk Assessment
The vulnerability allows an attacker to execute unauthorized queries against the database, potentially leading to data leakage or modification.
Recommendation
It is recommended to immediately update the WPCargo Track & Trace plugin to version 8.0.4 or later.
Other vulnerabilities in WPCargo Track & Trace
See all- CVE-2026-12713Critical
The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
- CVE-2026-116864High
The WPCargo Track & Trace plugin in versions up to and including 8.0.5 contains a PHP Object Injection vulnerability that allows injection of a malicious PHP object. This may lead to unauthorized actions within the WordPress application context.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS