→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-93549 · cart-rest-api-for-woocommerce

ارتقای سطح دسترسی (Privilege Escalation) در افزونه CoCart – Headless REST API for WooCommerce

The CoCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.9.0 through 4.9.6. This is due to its REST API authentication not filtering to its own endpoints, making nonce validation obsolete on all WordPress REST API endpoints. This makes it possible for unauthenticated attackers to call all REST API endpoints, including one to create new administrative users, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.