EUVD-2026-53734
GHSA-c29x-63cj-8wmw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) yields high confidentiality and integrity impact via database access; no availability impact, so A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
Articles & Coverage 1
AnalysisAI
SQL injection in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitised parameter, exposing the WordPress database. Reported by WPScan with publicly available exploit code, this flaw is notable for affecting a code path distinct from the previously patched CVE-2024-44004, indicating an incomplete prior fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a WordPress site have the WPCargo Track & Trace plugin (any version before 8.0.4) installed and active, with its vulnerable request handler reachable over the network - no authentication (PR:N), no user interaction (UI:N), and no non-default configuration are needed per the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are partially conflicting and warrant nuanced triage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to the WordPress site with malicious input in the vulnerable parameter, which is concatenated into a backend SQL query. Using UNION-based or blind injection techniques, the attacker extracts administrator password hashes and secret keys from the wp_users and wp_options tables, then cracks or reuses them to gain site control. … |
| Remediation | Vendor-released patch: upgrade the WPCargo Track & Trace plugin to version 8.0.4 or later, which the vendor has released to fix this specific injection path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running WPCargo and identify any versions prior to 8.0.4 for immediate priority remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wpcargo Track Trace
View allSame weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today