WPCargo Track & Trace CVE-2026-12713

Exploitation requires only that a WordPress site have the WPCargo Track & Trace plugin (any version before 8.0.4) installed and active, with its vulnerable request handler reachable over the network - no authentication (PR:N), no user interaction (UI:N), and no non-default configuration are needed per the CVSS vector. The primary limiting factor is deployment scope: the target must be running this specific, relatively niche plugin, and must not already be on 8.0.4+ or behind a WAF filtering SQL injection payloads. Note this is a separate code path from CVE-2024-44004, so sites patched only against that earlier CVE remain exploitable.

The signals are partially conflicting and warrant nuanced triage. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact - a genuinely severe profile, and publicly available exploit code lowers the barrier further. However, EPSS is only 0.18% (7th percentile) and the CVE is absent from CISA KEV, indicating no observed mass exploitation yet. This is consistent with a real but not-yet-widely-weaponised issue: the low EPSS likely reflects the plugin's limited deployment footprint rather than exploitation difficulty. Net assessment: a real, patch-worthy priority for any site running the plugin (unauthenticated SQLi with POC), but not an emergency across the broader internet given the niche product. The A:N rating is appropriate since SQL injection here reads/writes data rather than degrading availability.

An unauthenticated attacker sends a crafted HTTP request to the WordPress site with malicious input in the vulnerable parameter, which is concatenated into a backend SQL query. Using UNION-based or blind injection techniques, the attacker extracts administrator password hashes and secret keys from the wp_users and wp_options tables, then cracks or reuses them to gain site control. Public exploit code exists (WPScan), and the low attack complexity (AC:L) with no required authentication or user interaction makes automated exploitation straightforward once a target is identified.