Cart Rest Api For Woocommerce Vulnerabilities

The CoCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.9.0 through 4.9.6. This is due to its REST API authentication not filtering to its own endpoints, making nonce validation obsolete on all WordPress REST API endpoints. This makes it possible for unauthenticated attackers to call a...

CVSS:

8.8

(Wordfence)

Affected:

4.9.0 – 4.9.6

Fixed in:

4.9.7

Disclosed:

Oct 2, 2026

CVE-2026-93549 on NVD →

The CoCart – Headless REST API for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.8.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 4.8.4

Fixed in:

4.9.0

Disclosed:

Jul 23, 2026

CVE-2026-59536 on NVD →

The CoCart plugin for WordPress is vulnerable to Payment Bypass in versions up to, and including, 4.8.0. This is due to a lack of server-side payment verification. This makes it possible for unauthenticated attackers to bypass payments.

CVSS:

5.3

(Wordfence)

Affected:

up to 4.8.0

Fixed in:

4.9.0

Disclosed:

Jul 20, 2026

CVE-2026-10524 on NVD →

The CoCart – Headless ecommerce plugin for WordPress is vulnerable to unauthorized access of data, modification of data, or loss of data due to a missing capability check on an unknown function in versions up to, and including, 3.11.2. This makes it possible for unauthenticated attackers to make unauthorized use of the...

CVSS:

5.3

(Wordfence)

Affected:

up to 3.11.2

Fixed in:

3.12.0

Disclosed:

Nov 7, 2023

CVE-2023-47241 on NVD →