{
 "id": "WPSEC-2026-2441",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2441/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2441/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2441/index.md",
 "title": "WPCargo Track & Trace <= 8.0.5 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via 'shipmentID' Parameter",
 "description": "The WPCargo Track & Trace plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'shipmentID' parameter of the 'view_shipment_details' AJAX action in all versions up to, and including, 8.0.5, due to the action being registered for unauthenticated users and lacking any authorization or ownership check on the user-supplied shipment ID. This makes it possible for unauthenticated attackers to enumerate sequential shipment IDs and view the details of arbitrary shipments, including the names, addresses, phone numbers and email addresses of shippers and receivers, without knowing the tracking number.",
 "plugin": {
  "slug": "wpcargo",
  "name": "WPCargo Track & Trace",
  "full_name": "WPCargo Track & Trace",
  "wordpress_org": "https://wordpress.org/plugins/wpcargo/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpcargo/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpcargo"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.0.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.0.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.0.6",
 "remediation": "Update to 8.0.6 or later.",
 "fix_released": "2026-11-03T03:04:26+00:00",
 "published": "2026-11-04T03:40:43+00:00",
 "updated": "2026-11-03T13:22:13.267742+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2441/",
  "https://plugins.svn.wordpress.org/wpcargo/tags/8.0.6/",
  "https://wordpress.org/plugins/wpcargo/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpcargo",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}