WPCargo Track & Trace
Healthy: maintained, last release 3 Nov 2026, 7 releases in 24 months, no unpatched vulnerabilities.
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 65 |
| Support | No data |
| Reputation | No data |
Quick answers
- Is WPCargo Track & Trace still maintained?
- Yes. Last release 3 Nov 2026, 7 releases in the last 24 months. 3 Nov 2026 · wordpress.org
- Who owns WPCargo Track & Trace, and has it changed hands?
- Changed. New committer wptaskforce made a first commit on 3 Nov 2026. 3 Nov 2026 · SVN log
- Was WPCargo Track & Trace removed from wordpress.org?
- No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
- Is WPCargo Track & Trace safe?
- 9 known vulnerabilities, all fixed (latest in 8.0.4). Not on the exploited list. 28 Oct 2026 · Wordfence Intelligence
- Is the latest WPCargo Track & Trace update safe to install?
- Caution. Ownership change before 8.0.6: new committer wptaskforce made a first commit on 3 Nov 2026. No one-star spike after it. 3 Nov 2026 · Release history
Active signals
Facts we detected, with links to the source.
No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| wptaskforce | 10 Nov 2015 to 3 Nov 2026, 419 commits |
|---|
New committer wptaskforce made a first commit on 3 Nov 2026.
Maintenance
- Last release
- yesterday
- Releases, 24 months
- 7
- Tested up to
- 7.1 current
- Requires PHP
- 8.2 supported 8.2+
| Q1 2024 | 5 |
|---|---|
| Q2 2024 | 2 |
| Q3 2024 | 1 |
| Q4 2024 | 0 |
| Q1 2025 | 0 |
| Q2 2025 | 2 |
| Q3 2025 | 1 |
| Q4 2025 | 0 |
| Q1 2026 | 0 |
| Q2 2026 | 0 |
| Q3 2026 | 3 |
| Q4 2026 | 1 |
Last release 3 Nov 2026. Tested with WordPress 7.1 (current).
Reputation
Last 90 days: no reviews. Lifetime: 4.0.
| Q4 2023 | 5.0 |
|---|---|
| Q1 2024 | 5.0 |
| Q2 2024 | 3.0 |
Average rating fell from 5.0 to 3.0 between Q4 2023 and Q2 2024.
| 5 star | 22 |
|---|---|
| 4 star | 1 |
| 3 star | 0 |
| 2 star | 0 |
| 1 star | 7 |
- WPCargo Custom Field Add-ons Didn’t Work · 1 star · 26 May 2024
- very weak support, stay beware · 1 star · 16 Nov 2021
- Apis are very poor · 1 star · 2 Sep 2020
Security record
5 vulnerabilities in 24 months (9 on record), all patched (latest fixed in 8.0.4).
Show 9 patched vulnerabilities
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 28 Oct 2026 | WPCargo Track & Trace <= 8.0.5 - Authenticated (Author+) PHP Object Injection | 7.5 | <= 8.0.5 | Not affected | n/a |
| 3 Aug 2026 | WPCargo Track & Trace <= 8.0.3 - Unauthenticated SQL Injection | 7.5 | <= 8.0.3 | 8.0.4 | n/a |
| 23 Mar 2026 | WPCargo Track & Trace <= 8.0.2 - Missing Authorization | 5.3 | <= 8.0.2 | Not affected | n/a |
| 31 Mar 2025 | WPCargo Track & Trace <= 8.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference | 4.3 | <= 8.0.1 | Not affected | n/a |
| 11 Dec 2024 | WPCargo Track & Trace <= 8.0.1 - Missing authorization to Authenticated (Subscriber+) Settings Update | 4.3 | <= 8.0.1 | Not affected | n/a |
| 16 Sep 2024 | WPCargo Track & Trace <= 8.0.3 - Unauthenticated SQL Injection | 7.5 | <= 8.0.3 | 8.0.4 | n/a |
| 25 Apr 2022 | WPCargo Track & Trace <= 6.9.4 - Admin+ Stored Cross Site Scripting | 6.1 | <= 6.9.4 | 6.9.5 | n/a |
| 25 Apr 2022 | WPCargo Track & Trace <= 6.9.4 - Reflected Cross-Site Scripting | 6.1 | <= 6.9.4 | 6.9.5 | n/a |
| 21 Feb 2022 | WPCargo <= 6.8.9 - Unauthenticated Remote Code Execution | 9.8 | < 6.9.0 | 6.9.0 | n/a |
Changelog mentions of security fixes: 8.0.6 (security, nonce).
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Support
Support history appears after our first snapshots of the forum counts.
Momentum
10,000+ active installs. History builds with each weekly snapshot.
Momentum history builds with each snapshot.
Healthier alternatives
Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.
Facts
| Version | 8.0.6 |
|---|---|
| Author | Arni Cinco |
| Added | 10 Nov 2015 |
| Last updated | 3 Nov 2026 |
| Active installs | 10,000+ |
| Requires WordPress | not stated |
| Tested up to | 7.1.4 |
| Requires PHP | 8.2 |
| Category | Shipping & Logistics > Shipping Rate Calculators |
| Tags | order tracking, status tracking, shipment tracking, delivery calculator, transportation management |
Other plugins by this author: WP Obituary Manager, Subscription Form for Feedblitz
Questions
Is WPCargo Track & Trace still maintained?
Yes. Last release 3 Nov 2026, 7 releases in the last 24 months.
Who owns WPCargo Track & Trace, and has it changed hands?
Changed. New committer wptaskforce made a first commit on 3 Nov 2026.
Was WPCargo Track & Trace removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026.
Is WPCargo Track & Trace safe?
9 known vulnerabilities, all fixed (latest in 8.0.4). Not on the exploited list.
Is the latest WPCargo Track & Trace update safe to install?
Caution. Ownership change before 8.0.6: new committer wptaskforce made a first commit on 3 Nov 2026. No one-star spike after it.