{"id":"CVE-2026-116864","kind":"vulnerability","aliases":["CVE-2026-116864"],"related":[],"title":"WPCargo Track & Trace WordPress plugin: PHP object injection through author input","description":"Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.","summary":"WPCargo Track & Trace, a WordPress shipping-tracking plugin, accepts input that PHP deserializes as an object in versions up to 8.0.5. An attacker who can reach that input may be able to inject PHP objects, which can lead to code execution or data access depending on the available gadget classes.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","wordpress","wpcargo"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WPCargo Track & Trace plugin version in the WordPress admin under Plugins, or with `wp plugin get wpcargo`","fix":"- Move WPCargo Track & Trace above `8.0.5`; the sources do not name the exact fixed version","status":"open","published_at":"2026-10-29T16:18:01+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","triaged_at":"2026-10-29T16:29:51+00:00","updated_at":"2026-10-29T16:29:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T16:29:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move WPCargo Track & Trace above `8.0.5`; the sources do not name the exact fixed version\n- unknown whether a patched release exists","reach":"unknown","title":"WPCargo Track & Trace WordPress plugin: PHP object injection through author input","impact":"high","summary":"WPCargo Track & Trace, a WordPress shipping-tracking plugin, accepts input that PHP deserializes as an object in versions up to 8.0.5. An attacker who can reach that input may be able to inject PHP objects, which can lead to code execution or data access depending on the available gadget classes.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpcargo","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote code execution on the WordPress server is possible depending on gadgets","analyst_note":"Check the NVD entry and the WPCargo changelog for the fixed version and the exact vulnerable parameter, and whether authentication is required.","how_to_check":"- Check the installed WPCargo Track & Trace plugin version in the WordPress admin under Plugins, or with `wp plugin get wpcargo`\n- unknown whether the sources name the specific vulnerable code path or setting","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WPCargo Track & Trace at version 8.0.5 or older are in the affected range. The sources do not describe which roles or pages expose the vulnerable input, so the exposure path is unknown. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4054,"output_tokens":612,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116864':14A,17A '-2026':13A,16A '8.0.5':43B,81C 'abl':53B 'accept':31B 'access':66B 'attack':45B 'author':10A,73C 'avail':70B 'class':72B 'code':62B 'cve':12A,15A 'data':65B 'depend':67B 'deseri':35B 'execut':63B 'gadget':71B 'inject':8A,55B,76C 'input':11A,32B,50B 'lead':60B 'may':51B 'object':7A,38B,57B,75C 'packag':18B 'php':6A,19B,34B,56B,74C 'plugin':5A,30B 'reach':48B 'ship':28B 'shipping-track':27B 'trace':3A,24B,80C 'track':2A,23B,29B,79C 'version':40B,82C 'wordpress':4A,20B,26B 'wpcargo':1A,21B,22B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running WPCargo Track & Trace at version 8.0.5 or older are in the affected range. The sources do not describe which roles or pages expose the vulnerable input, so the exposure path is unknown. Sites that do not run this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116864","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116864","severity":null,"published_at":"2026-10-29T16:18:01+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:57+00:00","fetched_at":"2026-10-29T16:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}