What is GHSA-c29x-63cj-8wmw?

GHSA-c29x-63cj-8wmw is a security advisory published by GitHub Security Advisories with Critical severity. The WPCargo Track \u0026 Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a...

Which CVE IDs does GHSA-c29x-63cj-8wmw cover?

GHSA-c29x-63cj-8wmw covers the following CVE IDs: CVE-2026-12713. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c29x-63cj-8wmw?

GHSA-c29x-63cj-8wmw has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

GHSA-c29x-63cj-8wmwCriticalCVSS 9.1

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a...

Vendor

GitHub Security Advisories

Published

August 6, 2026

Last Modified

August 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-12713 →

📋 Description

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12713
https://wpscan.com/vulnerability/5fecb389-c327-4084-a5c8-61e5098386d6
https://github.com/advisories/GHSA-c29x-63cj-8wmw