CVE-2024-44004

CriticalCVSS 9.3

Published: 17/09/2024(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

The WPCargo Track & Trace plugin before version 8.0.4 contains an SQL injection vulnerability in the wpcargo module. An attacker can exploit improper neutralization of special elements in an SQL command.

Risk Assessment

The vulnerability allows an attacker to execute unauthorized queries against the database, potentially leading to data leakage or modification.

Recommendation

It is recommended to immediately update the WPCargo Track & Trace plugin to version 8.0.4 or later.

Other vulnerabilities in WPCargo Track & Trace

CVE-2026-12713Critical
The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.