Description
The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks. This affects a code path distinct from the one addressed by CVE-2024-44004.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WPCargo Track & Trace | < 8.0.4 | 8.0.4 |
References
- https://wpscan.com/vulnerability/5fecb389-c327-4084-a5c8-61e5098386d6/ exploit vdb-entry technical-description