CVE-2026-12713
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
Risk Assessment
An attacker may gain unauthorized access to the database, modify data, or take control of the website.
Recommendation
Update the WPCargo Track & Trace plugin to version 8.0.4 or later, which includes the fix.
Other vulnerabilities in WPCargo Track & Trace
See all- CVE-2024-44004Critical
The WPCargo Track & Trace plugin before version 8.0.4 contains an SQL injection vulnerability in the wpcargo module. An attacker can exploit improper neutralization of special elements in an SQL command.
- CVE-2026-116864High
The WPCargo Track & Trace plugin in versions up to and including 8.0.5 contains a PHP Object Injection vulnerability that allows injection of a malicious PHP object. This may lead to unauthorized actions within the WordPress application context.
Original NVD description (English source)
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS