CVE-2026-12713

CriticalCVSS 9.1

Published: 06/08/2026(UTC)Updated: 06/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The WPCargo Track & Trace WordPress plugin before version 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

Risk Assessment

An attacker may gain unauthorized access to the database, modify data, or take control of the website.

Recommendation

Update the WPCargo Track & Trace plugin to version 8.0.4 or later, which includes the fix.

Original NVD description (English source)

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.