Live › vulnerability › CVE-2026-116864
WPCargo Track & Trace, a WordPress shipping-tracking plugin, accepts input that PHP deserializes as an object in versions up to 8.0.5. An attacker who can reach that input may be able to inject PHP objects, which can lead to code execution or data access depending on the available gadget classes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Sites running WPCargo Track & Trace at version 8.0.5 or older are in the affected range. The sources do not describe which roles or pages expose the vulnerable input, so the exposure path is unknown. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get wpcargo8.0.5; the sources do not name the exact fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116864")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.