---
id: "CVE-2026-116864"
kind: "vulnerability"
aliases: ["CVE-2026-116864"]
title: "WPCargo Track & Trace WordPress plugin: PHP object injection through author input"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "wordpress", "wpcargo"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-29T16:18:01+00:00"
first_seen_at: "2026-10-29T16:25:57+00:00"
updated_at: "2026-10-29T16:29:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116864", "first_seen_at": "2026-10-29T16:25:57+00:00"}]
---

# WPCargo Track & Trace WordPress plugin: PHP object injection through author input

WPCargo Track & Trace, a WordPress shipping-tracking plugin, accepts input that PHP deserializes as an object in versions up to 8.0.5. An attacker who can reach that input may be able to inject PHP objects, which can lead to code execution or data access depending on the available gadget classes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPCargo Track & Trace plugin version in the WordPress admin under Plugins, or with `wp plugin get wpcargo`

## Fix

- Move WPCargo Track & Trace above `8.0.5`; the sources do not name the exact fixed version

## Timeline

- 2026-10-29T16:25:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116864

## From the sources

Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_