CVE-2021-25003observed exploitationCWE-94

CVE-2021-25003: vulnerability in WPCargo Track & Trace

WPCargo < 6.9.0 - Unauthenticated RCE

Published · Updated

Follow this CVE+ Monitor WPCargo Track & Trace

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

72Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 56%
from disclosure to weapon104 days
Published on NVDMar 14
1st PoC+104d
VulnCheck+626d
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
Affected products
Unknown · WPCargo Track & Trace
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WPCargo Track & Trace

In the same product, most dangerous first.

CVE-2022-1436—WPCargo Track & Trace < 6.9.5 - Reflected Cross Site ScriptingEPSS 0.8%CVE-2022-1435—WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site ScriptingEPSS 0.6%CVE-2026-12713CRITICALWPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_numberEPSS 0.5%