CVE-2026-12713: Unknown Wpcargo Track & Trace

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

Affected products

• Unknown Wpcargo Track & Trace: before 8.0.4 (fixed in 8.0.4)

Published 2026-08-06. Last modified 2026-08-26.