CVE-2026-93549

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-04

Last updated on: 2026-10-06

Assigner: WPScan

Description

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-04

EPSS Evaluated

2026-10-18

NVD

CVE-2026-93549

EUVD

EUVD-2026-92075

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	CoCart	4.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

The CoCart WordPress plugin before version 4.9.7 has a flaw where its REST API authentication filter is not limited to its own endpoints. This disables WordPress core's REST nonce protection for all routes, allowing a cross-site request forgery (CSRF) attack. An attacker could exploit this to create a new administrator account using a logged-in administrator's session.

Detection Guidance

Check if CoCart plugin version is between 4.9.0 and 4.9.6. Inspect WordPress REST API endpoints for unauthorized access attempts or unexpected administrator account creations. Review server logs for suspicious CSRF-related requests targeting WordPress core routes.

Impact Analysis

An attacker could gain full administrative control of a WordPress site by creating a new admin account. This requires access to a logged-in administrator's session but bypasses security protections. The impact includes potential site takeover, data theft, or malware installation.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update CoCart plugin to version 4.9.7 or later immediately. Disable REST API access for non-admin users if possible. Implement additional CSRF protections like WordPress nonces on all forms. Monitor for unauthorized administrator account creations.

Hi! I’m here to help you understand CVE-2026-93549. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70