CVE-2026-93549 — CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every…
Published: 2026-10-04 · CVSS: 8.8 · CVSS 3.1
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7