CVE-2026-116864: WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability

Q: Who needs to be able to interact with the vulnerable functionality to exploit this issue?

The vulnerability is described as requiring author-level privileges. An attacker would need an authenticated WordPress account with the Author role or equivalent capabilities.

Q: Which installations are affected?

WPCargo Track & Trace versions 8.0.5 and earlier are identified as affected.

Q: How severe is the potential impact after exploitation?

The supplied CVSS vector rates confidentiality, integrity, and availability impacts as high. The issue is network-accessible, has low attack complexity, requires no user interaction, and does not affect scope.

Published Oct 29, 2026

Updated

Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who needs to be able to interact with the vulnerable functionality to exploit this issue?

The vulnerability is described as requiring author-level privileges. An attacker would need an authenticated WordPress account with the Author role or equivalent capabilities.

Which installations are affected?

WPCargo Track & Trace versions 8.0.5 and earlier are identified as affected.

How severe is the potential impact after exploitation?

The supplied CVSS vector rates confidentiality, integrity, and availability impacts as high. The issue is network-accessible, has low attack complexity, requires no user interaction, and does not affect scope.

CVE-2026-116864: WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability

Event History

Frequently Asked Questions

Who needs to be able to interact with the vulnerable functionality to exploit this issue?

Which installations are affected?

How severe is the potential impact after exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who needs to be able to interact with the vulnerable functionality to exploit this issue?

Which installations are affected?

How severe is the potential impact after exploitation?