Is WPCargo Track & Trace safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (8.0.6). As of 2026-11-04. 9 issues are on record for older versions; version 8.0.6 or newer fixes all of them that state a fix. Keep WPCargo Track & Trace on the latest version (8.0.6) and remove it if you do not use it.

Which versions of WPCargo Track & Trace are vulnerable?

Known issues on record (newest first): PHP object injection (8.0.5 and older, fixed in 8.0.6); SQL injection (older than 8.0.4, fixed in 8.0.4); Missing authorization check (8.0.2 and older, fixed in 8.0.3); Cross-site scripting (XSS) (older than 6.9.5, fixed in 6.9.5); Reflected cross-site scripting (XSS) (older than 6.9.5, fixed in 6.9.5); Remote code execution (older than 6.9.0, fixed in 6.9.0). The full list with sources is on this page.

What is the latest version of WPCargo Track & Trace?

8.0.6, according to wordpress.org (last updated 2026-11-03). It has 10,000+ active installs.

What should I do if my WPCargo Track & Trace is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update wpcargo). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · wpcargo · data as of 2026-11-04

Is WPCargo Track & Trace safe? Known vulnerabilities and latest version

Latest version: 8.0.6
Last updated: 2026-11-03
Active installs: 10,000+
Known issues on record: 9
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 8.2+

WPCargo is a track & trace system for courier, courier script, parcel, balikbayan system, shipment and transportation management system, ideal sol … — by Arni Cinco

What to do

Update to the latest version (8.0.6). Anything older than 8.0.6 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get wpcargo --field=version shows what you run; wp plugin update wpcargo updates it.

Check your version

Known vulnerabilities

9 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

high 7.2 CVE-2026-116864 · published 2026-10-29

PHP object injection in WPCargo Track & Trace (8.0.5 and older)

Affected: 8.0.5 and older
Fixed in: 8.0.6 *
Access needed (per CVSS): Needs an admin-level account
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

NVD CVE-2026-116864 Patchstack advisory

critical 9.1 CVE-2026-12713 · published 2026-08-06

SQL injection in WPCargo Track & Trace (older than 8.0.4)

Affected: older than 8.0.4
Fixed in: 8.0.4
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

NVD CVE-2026-12713 WPScan advisory

high 7.5 CVE-2026-25401 · published 2026-03-25

Missing authorization check in WPCargo Track & Trace (8.0.2 and older)

Affected: 8.0.2 and older
Fixed in: 8.0.3 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

NVD CVE-2026-25401 Patchstack advisory

medium 4.3 CVE-2025-31609 · published 2025-03-31

Missing authorization check in WPCargo Track & Trace (8.0.2 and older)

Affected: 8.0.2 and older
Fixed in: 8.0.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2025-31609 Patchstack advisory

medium 5.4 CVE-2024-54271 · published 2024-12-13

Missing authorization check in WPCargo Track & Trace (8.0.2 and older)

Affected: 8.0.2 and older
Fixed in: 8.0.3 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

NVD CVE-2024-54271 Patchstack advisory

critical 9.8 CVE-2024-44004 · published 2024-09-17

SQL injection in WPCargo Track & Trace (older than 8.0.4)

Affected: older than 8.0.4
Fixed in: 8.0.4
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4.

NVD CVE-2024-44004 Patchstack advisory

medium 4.8 CVE-2022-1435 · published 2022-05-16

Cross-site scripting (XSS) in WPCargo Track & Trace (older than 6.9.5)

Affected: older than 6.9.5
Fixed in: 6.9.5
Access needed (per CVSS): Needs an admin-level account; someone on the site has to click a link or open a page
Range from: advisory text · score by NVD

Details from the advisory

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

NVD CVE-2022-1435 WPScan advisory

medium 6.1 CVE-2022-1436 · published 2022-05-16

Reflected cross-site scripting (XSS) in WPCargo Track & Trace (older than 6.9.5)

Affected: older than 6.9.5
Fixed in: 6.9.5
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: advisory text · score by NVD

Details from the advisory

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks.

NVD CVE-2022-1436 WPScan advisory

critical 9.8 CVE-2021-25003 · published 2022-03-14

Remote code execution in WPCargo Track & Trace (older than 6.9.0)

Affected: older than 6.9.0
Fixed in: 6.9.0
Access needed (per CVSS): No login needed
Range from: advisory text · score by NVD

Details from the advisory

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE

NVD CVE-2021-25003 WPScan advisory

Recent activity

2026-11-03 — latest release on wordpress.org (8.0.6).
2026-10-29 — PHP object injection disclosed (CVE-2026-116864), fixed in 8.0.6.
2026-08-06 — SQL injection disclosed (CVE-2026-12713), fixed in 8.0.4.
2026-03-25 — Missing authorization check disclosed (CVE-2026-25401), fixed in 8.0.3.

Free. We check the CVE feeds every day and email you only when a new issue for WPCargo Track & Trace (wpcargo) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Missing authorization (3) · SQL injection (2) · Cross-site scripting (XSS) (2) · PHP object injection (1) · Remote code execution (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/wpcargo (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/wpcargo"><img src="https://laskyr.com/plugins/wpcargo/badge.svg" alt="WPCargo Track & Trace vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is WPCargo Track & Trace safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (8.0.6)

What to do

Check your version

Known vulnerabilities

PHP object injection in WPCargo Track & Trace (8.0.5 and older)

SQL injection in WPCargo Track & Trace (older than 8.0.4)

Missing authorization check in WPCargo Track & Trace (8.0.2 and older)

Missing authorization check in WPCargo Track & Trace (8.0.2 and older)

Missing authorization check in WPCargo Track & Trace (8.0.2 and older)

SQL injection in WPCargo Track & Trace (older than 8.0.4)

Cross-site scripting (XSS) in WPCargo Track & Trace (older than 6.9.5)

Reflected cross-site scripting (XSS) in WPCargo Track & Trace (older than 6.9.5)

Remote code execution in WPCargo Track & Trace (older than 6.9.0)

Recent activity

Get an email when WPCargo Track & Trace has a new vulnerability

Browse vulnerabilities

Where this data comes from