The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.56148·Published 2022-03-14·Fixed in 6.9.0CWE-94