This vulnerability in WPCargo Track & Trace (<= 8.0.2) is due to missing authorization checks caused by misconfigured access control levels. It allows users with some privileges (low privileges) to access or perform actions without proper authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact.

An attacker with low privileges on the affected system could exploit this vulnerability to gain unauthorized access to certain data or functions, potentially leading to limited confidentiality breaches. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — no official fixes or patches have been published by the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is available, review and tighten access control configurations in WPCargo Track & Trace to ensure proper authorization enforcement. Avoid granting unnecessary privileges to users.