CVE-2026-59536

Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...

CVE-2026-47741

CVE-2026-47741 affects Shopper, a Headless e-commerce Admin Panel. Before 2.8.0, CreateOrderFromCartAction::execute created the Order row before incrementing the discount’s total_use, allowing a race condition under concurrent checkout that silently exceeded the global usage_limit and applied the...

CVE-2026-47741 Shopper: Race condition on Discount.usage_limit allows silent over-redemption

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's totaluse counter. Under concurrent checkout pressure Black Friday, flash sale, viral coupon, the global usagelimit was...

PT-2026-44942

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.8.0 Description A race condition exists in the CreateOrderFromCartAction::execute function. The system creates an order row before verifying and incrementing the total use counter of a discount. Under high concurren...

CVE-2023-47241 WordPress CoCart – Headless ecommerce plugin <= 3.11.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through = 3.11.2...

CVE-2023-47241 WordPress CoCart – Headless ecommerce plugin <= 3.11.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in CoCart Headless CoCart – Headless ecommerce cart-rest-api-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoCart – Headless ecommerce: from n/a through = 3.11.2...

PT-2025-1536 · Unknown · Cocart – Headless Ecommerce

Name of the Vulnerable Software and Affected Versions: CoCart – Headless ecommerce versions through 3.11.2 Description: The issue affects CoCart – Headless ecommerce due to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels...