External risk intelligence

WPCargo Track & Trace SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-12713

The vulnerability affects a WordPress plugin, which is a web application component designed to handle incoming web traffic. Since this specific flaw is exploitable by unauthenticated users via the public web interface, it is very likely to be reachable from the internet in typical deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a WordPress plugin could allow unauthorized users to access or manipulate sensitive data through SQL injection attacks. This type of flaw, when exploitable without authentication, presents a significant risk to data integrity and confidentiality. The primary concern is to confirm if this specific plugin is in use and exposed to the internet.

Plugin flaw allows unauthorized data access.
Unauthenticated access amplifies risk.
Confirm usage and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted request to a web server hosting the vulnerable WordPress plugin. This request targets a specific parameter that is not properly validated, allowing the attacker to inject malicious SQL code. Successful exploitation can lead to unauthorized access and modification of sensitive data within the website's database.

No user authentication needed.
Inject SQL via a parameter.
Leads to database compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated users to inject malicious SQL code into the application. When supported by the advisory, this could lead to unauthorized access to or modification of sensitive data stored in the database.

Database information and integrity.
Via unauthenticated SQL injection attacks.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the WPCargo Track & Trace WordPress plugin, making it a concern for website owners and application administrators. The immediate first step is to identify all instances of this plugin, confirm their exposure to the internet, and determine their business criticality. Once these are established, the accountable owner for each affected instance should be identified to plan the appropriate remediation.

Website owners and application administrators.
Confirm plugin exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WPCargo Track & Trace plugin?

WPCargo Track & Trace is a software extension for WordPress websites designed to provide shipment tracking and logistics management features. It allows site administrators to offer customers real-time updates on package statuses, typically by integrating custom input forms that interact directly with the site's backend database to retrieve or display shipment records.

What does SQL injection mean for CVE-2026-12713?

This vulnerability is classified as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. In plain English, the plugin fails to clean data entered by users before including it in database queries. Because of this, an attacker can input malicious commands that the database interprets as instructions, potentially letting them view, change, or delete data they are not authorized to access.

How does an attacker trigger this vulnerability?

An attacker triggers this bug by sending a specially crafted web request to the server that includes malicious SQL code within a specific, unsanitized parameter. Importantly, this attack path is distinct from previous issues, such as those addressed in CVE-2024-44004. If the plugin is properly secured or updated, or if the specific vulnerable code path is not exercised by a request, the injection will not succeed.

Is my website at risk from this CVE?

According to Halo Surface Signal, this vulnerability is very likely to be reachable from the internet. Because the plugin is a web component designed to handle public traffic and the flaw requires no authentication to exploit, any internet-facing WordPress site running an affected version of WPCargo Track & Trace is potentially accessible to unauthorized parties.

What should I do if I use WPCargo Track & Trace?

Your first priority is to locate every instance of the plugin within your infrastructure and verify which ones are exposed to the internet. Once identified, document the business criticality of those specific sites and coordinate with the accountable owners. The primary goal is to ensure you have a clear plan to update the plugin to version 8.0.4 or later to close the security gap.

References

wpscan.com/vulnerability/5fecb389-c327-4084-a5c8-61e5098386d6/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.