CVE-2026-10524

Received Received - Intake

Arbitrary Price Manipulation in CoCart WordPress Plugin

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WPScan

Description

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-10524

Affected Vendors & Products

Vendor	Product	Version / Range
co_cart	co_cart	to 4.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the CoCart WordPress plugin before version 4.9.0. It allows unauthenticated users to manipulate product prices by sending arbitrary values through a public REST API endpoint. This bypasses the actual product pricing, enabling attackers to set any price they want when adding items to the cart.

Detection Guidance

Check for unauthorized price modifications in WooCommerce orders by reviewing order logs and API requests. Monitor REST API endpoints for the CoCart plugin for suspicious price parameter changes.

Impact Analysis

If exploited, this vulnerability could allow attackers to purchase products at incorrect, lower prices. This could lead to financial losses for the website owner or store. Customers might also face issues if orders are processed with incorrect totals.

Compliance Impact

This vulnerability could lead to financial fraud by allowing unauthenticated users to manipulate product prices, which may result in unauthorized transactions. Such unauthorized transactions could violate compliance requirements under GDPR (if personal data is involved) or HIPAA (if healthcare-related transactions are affected) due to improper data handling and financial integrity issues.

Mitigation Strategies

Update the CoCart WordPress plugin to version 4.9.0 or later immediately. Disable the CoCart REST API endpoints if not required. Implement server-side price validation for WooCommerce orders.

Hi! I’m here to help you understand CVE-2026-10524. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70