CVE-2026-10524 — CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its publi…
Published: 2026-08-06 · CVSS: 7.5 · CVSS 3.1
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7