34 matches found
CVE-2026-93549
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
EUVD-2026-92075
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
CVE-2026-93549
The CoCart WordPress plugin, in versions 4.9.0 through 4.9.6 , contains a vulnerability where it fails to scope its REST API authentication filter to its specific endpoints. This oversight disables the WordPress core REST nonce protection across all routes. An attacker can exploit this flaw to pe...
WordPress CoCart plugin 4.9.0-4.9.6 - Administrator Account Creation vulnerability
Administrator Account Creation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin CoCart – Headless ecommerce versions 4.9.0-4.9.6...
CVE-2026-93549: Cross-Site Request Forgery (CSRF)
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account usin...
PT-2026-104610
Name of the Vulnerable Software and Affected Versions CoCart WordPress plugin versions prior to 4.9.7 Description The plugin fails to scope its REST API authentication filter to its own endpoints. This action disables the REST nonce protection provided by WordPress core for every route...
WordPress CoCart plugin < 4.9.0 - Unauthenticated Arbitrary Price Manipulation vulnerability
Unauthenticated Arbitrary Price Manipulation vulnerability discovered by hoangphuong in WordPress Plugin CoCart – Headless ecommerce versions 4.9.0...
EUVD-2026-54195
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...
CVE-2026-10524
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...
CVE-2026-10524 CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...
CVE-2026-10524
The CVE reports a vulnerability in the CoCart WordPress plugin where versions before 4.9.0 fail to validate a user-supplied price against the actual product price when items are added via a public REST API endpoint. This allows unauthenticated users to set arbitrary prices and complete WooCommerc...
CVE-2026-10524 CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...
PT-2026-68634
Name of the Vulnerable Software and Affected Versions CoCart WordPress plugin versions prior to 4.9.0 Description An issue exists where the software fails to validate user-supplied price values against the actual product price when items are added to the cart via public REST API endpoints. This...
CVE-2026-10524: External Control of Assumed-Immutable Web Parameter
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...
CVE-2026-59536
Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...
CVE-2026-59536 WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in CoCart – Headless ecommerce = 4.8.4 versions...
