CVE-2026-116864

Name of the Vulnerable Software and Affected Versions WPCargo Track & Trace versions prior to 8.0.6

Description The WPCargo Track & Trace plugin for WordPress allows authenticated attackers with author-level access and above to perform PHP Object Injection. This occurs due to the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the software, the presence of a POP chain in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update WPCargo Track & Trace to version 8.0.6 or later.