CVE-2021-25003: Wptaskforce Wpcargo Track & Trace

Critical severity, CVSS 9.8. EPSS: 56.1% chance of exploitation in the next 30 days.

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE

Affected products

• Wptaskforce Wpcargo Track & Trace: before 6.9.0 (fixed in 6.9.0)

Published 2022-03-14. Last modified 2026-06-17.