Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-93549: CoCart plugin lets attackers add admin accounts via API
CVE-2026-93549 · published 15 days ago
Summary
The CoCart WordPress add‑on (versions 4.9.0 through 4.9.6) fails to limit its API authentication check, turning off WordPress’s built‑in protection for all API calls. This lets a malicious user exploit a logged‑in administrator’s session to create a new admin account without permission. Update the plug‑in to version 4.9.7 or later, or disable the affected API endpoints until you can apply the update.
What to do
- Update unknown cocart to version 4.9.7 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | cocart | < 4.9.7 |
Original advisory text
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published4 Oct 2026
Updated14 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta