WPCargo Track & Trace <= 8.0.5 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via 'shipmentID' Parameter
- ID
- WPSEC-2026-2441
- Plugin
- WPCargo Track & Trace (wpcargo)
- Affected
- all versions before 8.0.6
- Remediation
- Update to 8.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- WPCargo Track & Trace on WPSec AttackSurface
- Fix released
- Published
Description
The WPCargo Track & Trace plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'shipmentID' parameter of the 'view_shipment_details' AJAX action in all versions up to, and including, 8.0.5, due to the action being registered for unauthenticated users and lacking any authorization or ownership check on the user-supplied shipment ID. This makes it possible for unauthenticated attackers to enumerate sequential shipment IDs and view the details of arbitrary shipments, including the names, addresses, phone numbers and email addresses of shippers and receivers, without knowing the tracking number.
References
- https://wpsec.com/vuln/WPSEC-2026-2441/
- https://plugins.svn.wordpress.org/wpcargo/tags/8.0.6/
- https://wordpress.org/plugins/wpcargo/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS