CVE-2026-24589 PUBLISHED

WordPress Cargus plugin <= 1.5.8 - Sensitive Data Exposure vulnerability

Assigner: Patchstack
Reserved: 23.01.2026 Published: 23.01.2026 Updated: 23.01.2026

Insertion of Sensitive Information Into Sent Data vulnerability in Cargus eCommerce Cargus cargus allows Retrieve Embedded Sensitive Data.This issue affects Cargus: from n/a through <= 1.5.8.

Product Status

Vendor	Cargus eCommerce
Product	Cargus
Versions	Default: unaffected affected from n/a to <= 1.5.8 (incl.)

Credits

Legion Hunter | Patchstack Bug Bounty Program finder

References

https://patchstack.com/database/Wordpress/Plugin/cargus/vulnerability/wordpress-cargus-plugin-1-5-8-sensitive-data-exposure-vulnerability?_s_id=cve

Problem Types

Insertion of Sensitive Information Into Sent Data CWE

Impacts

Retrieve Embedded Sensitive Data