SZB-158d6e9bd0
EUVD lists author-level PHP object injection in WPCargo Track & Trace up to 8.0.5
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Arni Cinco
- Product
- WPCargo Track & Trace
- First seen
Summary
An EUVD record (EUVD-2026-112984), shared via a Mastodon post, describes an author-level PHP object injection flaw in WPCargo Track & Trace up to version 8.0.5. The record gives a CVSS v3.1 score of 7.2/10 and was published 2026-10-29 and updated 2026-10-30.
If you use Arni Cinco
Update WPCargo Track & Trace to a version later than 8.0.5 once available
Check EUVD-2026-112984 for vendor guidance and patch status
Limit author account privileges until the plugin is patched
What the sources say 1
· Mastodon: “Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.” Source