Executive Summary
A critical unauthenticated SQL injection vulnerability (CVE-2026-12713) has been disclosed in the WPCargo Track & Trace plugin for WordPress. Discovered and published via NIST NVD, the flaw exists in a code path separate from the previously patched CVE-2024-44004, meaning sites that updated for the prior advisory remain vulnerable until they apply version 8.0.4.
CVSS Score: 9.1 (Critical)
With no authentication required, a remote attacker can craft malicious requests to read, modify, or exfiltrate data from the underlying WordPress database. Shipping and logistics operators relying on this plugin for order tracking are at particular risk.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-12713 |
| CVSS Score | 9.1 (Critical) |
| Type | Unauthenticated SQL Injection |
| Attack Vector | Network (no authentication required) |
| Privileges Required | None |
| User Interaction | None |
| Scope | Database read / write |
| Prior Related CVE | CVE-2024-44004 (separate code path) |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| WPCargo Track & Trace | < 8.0.4 | 8.0.4 |
Important: Sites that patched CVE-2024-44004 are still vulnerable — this flaw is in a distinct code path not addressed by that fix.
Technical Details
The vulnerability stems from insufficient sanitization and escaping of a user-supplied parameter before it is interpolated into a SQL query. Because the affected endpoint requires no authentication, an attacker can send a crafted HTTP request directly to the vulnerable parameter without needing any WordPress account.
Attack Flow:
1. Attacker identifies WordPress site running WPCargo Track & Trace < 8.0.4
2. Attacker crafts HTTP request targeting the unsanitized parameter
3. Malicious SQL payload injected into the live database query
4. Attacker enumerates: database schema, user credentials, order data
5. Depending on DB permissions — data modification or exfiltration proceedsPotential Impact
| Impact | Description |
|---|---|
| Data Exfiltration | Full read access to WordPress database contents |
| Credential Theft | wp_users table — hashed passwords, email addresses |
| Order Manipulation | Tamper with shipment tracking records |
| Account Takeover | Password hash cracking → admin access |
| Persistence | Inject malicious content or backdoor accounts |
Immediate Remediation
Step 1: Update to 8.0.4
# Via WP-CLI
wp plugin update wpcargo
# Verify installed version
wp plugin get wpcargo --field=versionOr update through WordPress admin: Plugins > Installed Plugins > WPCargo Track & Trace > Update Now.
Step 2: Verify Both CVEs Are Patched
# Confirm version is 8.0.4 or later
wp plugin list --name=wpcargo --fields=name,version,statusVersion 8.0.4 addresses both CVE-2024-44004 and CVE-2026-12713. Sites on any earlier version are exposed to at least one of these injection paths.
Step 3: Check for Exploitation Evidence
# Review recent access logs for suspicious GET/POST patterns to WPCargo endpoints
grep -i "wpcargo\|track" /var/log/nginx/access.log | grep -E "UNION|SELECT|FROM|information_schema" | tail -50
# Audit recent admin account changes
wp user list --role=administrator --fields=ID,user_login,user_registered,user_emailStep 4: Rotate Credentials If Compromise Is Suspected
# Generate new WordPress security keys
wp config shuffle-salts
# Reset admin password
wp user update 1 --user_pass="$(openssl rand -base64 32)"Detection Indicators
| Indicator | Description |
|---|---|
Unexpected UNION SELECT in URL parameters | Active SQLi exploitation attempt |
| Unusual outbound traffic from web server | Data exfiltration post-exploitation |
| New administrator accounts | Post-exploitation persistence |
| Modified tracking records | Database tampering via SQL injection |
| Error log entries referencing WPCargo | Failed injection attempts or plugin errors |
Workaround (If Immediate Patching Is Blocked)
If you cannot update immediately:
- Deactivate the WPCargo plugin until patching is possible
- Block external access to WPCargo tracking endpoints at your WAF or Nginx level
- Enable query logging to monitor for injection patterns
- Deploy a WAF rule targeting SQL keywords in WPCargo-related request paths
Post-Remediation Checklist
- Plugin updated to version 8.0.4 or later
-
wp core verify-checksums— WordPress core integrity confirmed - Access logs reviewed for historical exploitation
- No unauthorized administrator accounts present
- Database credentials rotated (if compromise suspected)
- WordPress security keys regenerated
- WAF or Wordfence/Sucuri deployed for ongoing monitoring