Wpcargo Track & Trace CVEs and Security Vulnerabilities

CVE-2026-12713

WPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_number

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Arni Cinco Wordpress

Products

Wpcargo Track & Trace Wordpress

CVE-2026-25401

WordPress WPCargo Track & Trace plugin <= 8.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed