CVE-2026-116864
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The WPCargo Track & Trace plugin in versions up to and including 8.0.5 contains a PHP Object Injection vulnerability that allows injection of a malicious PHP object. This may lead to unauthorized actions within the WordPress application context.
Risk Assessment
Exploitation could allow an attacker to execute code or manipulate data in the WordPress site, potentially leading to site compromise.
Recommendation
Update the WPCargo Track & Trace plugin to a version later than 8.0.5, or disable it if no update is available.
Other vulnerabilities in WPCargo Track & Trace
See all- CVE-2026-12713Critical
The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
- CVE-2024-44004Critical
The WPCargo Track & Trace plugin before version 8.0.4 contains an SQL injection vulnerability in the wpcargo module. An attacker can exploit improper neutralization of special elements in an SQL command.
Original NVD description (English source)
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS