WPCargo Track & Trace: PHP Object Injection in WordPress plugin
The WordPress plugin WPCargo Track & Trace up to and including version 8.0.5 is affected by a PHP Object Injection vulnerability (CWE-502). According to the CVSS vector, an attacker needs high privileges (Author role) and can affect confidentiality, integrity and availability of the server. Patchstack rates the issue as medium priority and expects exploitation to occur, but no exploitation is currently known.
Arni Cinco · WPCargo Track & Trace
