The vulnerability CVE-2024-44004 in Arni Cinco WPCargo Track & Trace (<= 8.0.2) is an SQL Injection issue caused by improper neutralization of special elements in SQL commands. This allows unauthenticated remote attackers to inject SQL code, potentially compromising the confidentiality of the database. The CVSS 3.1 score of 9.3 reflects network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact and low availability impact.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive data from the backend database. The vulnerability does not indicate integrity or availability impacts but does affect confidentiality severely. Since the attack requires no privileges or user interaction, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or temporary mitigations recommended by the vendor. Monitoring vendor channels for updates is critical. Avoid exposing the vulnerable service directly to untrusted networks if possible.