Cross-Site Request Forgery in CoCart WordPress Plugin

Executive Summary

The CoCart WordPress plugin before version 4.9.7 has a flaw where its REST API authentication filter is not limited to its own endpoints. This disables WordPress core's REST nonce protection for all routes, allowing a cross-site request forgery (CSRF) attack. An attacker could exploit this to create a new administrator account using a logged-in administrator's session.

Useful 0 Not Useful 0

Detection Guidance

Check if CoCart plugin version is between 4.9.0 and 4.9.6. Inspect WordPress REST API endpoints for unauthorized access attempts or unexpected administrator account creations. Review server logs for suspicious CSRF-related requests targeting WordPress core routes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full administrative control of a WordPress site by creating a new admin account. This requires access to a logged-in administrator's session but bypasses security protections. The impact includes potential site takeover, data theft, or malware installation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update CoCart plugin to version 4.9.7 or later immediately. Disable REST API access for non-admin users if possible. Implement additional CSRF protections like WordPress nonces on all forms. Monitor for unauthorized administrator account creations.

Useful 0 Not Useful 0