What is the CVSS score of CVE-2024-44004?

CVE-2024-44004 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WPCargo Track & Trace are affected by CVE-2024-44004?

WPCargo Track & Trace WordPress plugin (versions through 8.0.2) contains a critical SQL injection vulnerability enabling unauthenticated remote attackers to read, modify, or delete the entire…

How to fix or mitigate CVE-2024-44004?

Within 24 hours: disable the WPCargo Track & Trace plugin on all WordPress installations, identify affected sites, and review database access logs for unauthorized activity since plugin deployment. Within 7 days: either remove the plugin entirely or migrate to a patched alternative; conduct a comprehensive database audit to assess scope of any data exposure and confirm integrity. Within 30 days: implement Web Application Firewall rules to block SQL injection patterns targeting WordPress plugins, establish continuous monitoring for database query anomalies, and complete a full audit of all WordPress plugins in production use to identify similar vulnerabilities.

WPCargo Track & Trace CVE-2024-44004

CRITICAL

SQL Injection (CWE-89)

2024-09-17 audit@patchstack.com

WordPress SQLi Track Trace Wordpress Plugin Wptaskforce

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQL injection yielding full database read/write concurs with AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H, though PR:N depends on the unverified injectable endpoint.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 18, 2026 - 14:28 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Aug 18, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Aug 18, 2026 - 14:22 NVD

9.3 (CRITICAL) 9.8 (CRITICAL)

CVSS changed

Apr 23, 2026 - 15:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

CVE Published

Sep 17, 2024 - 23:15 nvd

CRITICAL 9.8

CVE Published

Sep 17, 2024 - 23:15 cve.org

CRITICAL 9.3

DescriptionNVD

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

AnalysisAI

SQL injection in the WPCargo Track & Trace WordPress plugin (all versions up to and including 8.0.2) lets remote attackers inject arbitrary SQL through improperly neutralized input, exposing the entire WordPress database. The flaw carries a CVSS 9.8 with a network/no-privilege vector, meaning a single crafted request can read, alter, or destroy site data. No public exploit identified at time of analysis, and EPSS is modest (0.41%, 61st percentile), so it is not currently trending as mass-exploited.

Technical ContextAI

The vulnerability is a classic CWE-89 SQL Injection: user-controllable input reaches a database query without proper parameterization or escaping. WPCargo Track & Trace is a WordPress courier/logistics shipment-tracking plugin (CPE cpe:2.3:a:wptaskforce:track_&_trace) that runs on top of the WordPress MySQL/MariaDB backend, so a successful injection operates against the wp_* schema - including wp_users and wp_usermeta. Because WordPress plugins share the site's single database connection and privileges, an injectable parameter typically yields full read/write access to all site tables rather than an isolated dataset.

RemediationAI

Upgrade to a WPCargo Track & Trace release later than 8.0.2 as the primary fix; the description bounds impact at '<= 8.0.2,' but no exact fixed version number is stated in the provided data, so confirm the patched build directly against the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wpcargo/vulnerability/wordpress-wpcargo-track-trace-plugin-7-0-6-sql-injection-vulnerability?_s_id=cve) before deploying. If an immediate update is not possible, compensating controls include deploying a WAF rule (e.g., Patchstack's virtual patch or a generic SQLi ruleset) in front of the site to filter injection payloads to the plugin's endpoints, restricting or IP-allowlisting access to the tracking pages/AJAX handlers the plugin exposes, and - if the tracking functionality is non-essential - deactivating and removing the plugin entirely, which fully eliminates the exposure at the cost of losing shipment-tracking features. WAF filtering reduces but does not guarantee elimination of the risk, since injection payloads can be obfuscated, so treat it as interim only.