WPCargo Track & Trace vulnerabilities

The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

The WPCargo Track & Trace plugin before version 8.0.4 contains an SQL injection vulnerability in the wpcargo module. An attacker can exploit improper neutralization of special elements in an SQL command.

The WPCargo Track & Trace plugin in versions up to and including 8.0.5 contains a PHP Object Injection vulnerability that allows injection of a malicious PHP object. This may lead to unauthorized actions within the WordPress application context.