# WPCargo Track & Trace <= 8.0.5 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure via 'shipmentID' Parameter

- **ID:** WPSEC-2026-2441
- **Plugin:** WPCargo Track & Trace (`wpcargo`), https://wordpress.org/plugins/wpcargo/
- **Affected versions:** all versions before 8.0.6
- **Fixed in:** 8.0.6 (Update to 8.0.6 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpcargo
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2441/

## Description

The WPCargo Track & Trace plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'shipmentID' parameter of the 'view_shipment_details' AJAX action in all versions up to, and including, 8.0.5, due to the action being registered for unauthenticated users and lacking any authorization or ownership check on the user-supplied shipment ID. This makes it possible for unauthenticated attackers to enumerate sequential shipment IDs and view the details of arbitrary shipments, including the names, addresses, phone numbers and email addresses of shippers and receivers, without knowing the tracking number.

## References

- https://wpsec.com/vuln/WPSEC-2026-2441/
- https://plugins.svn.wordpress.org/wpcargo/tags/8.0.6/
- https://wordpress.org/plugins/wpcargo/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2441/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.