CoCart CVE-2026-10524

No special conditions are required beyond CoCart (version before 4.9.0) being installed and active on a WooCommerce site - this is the default, intended deployment state of the plugin, since exposing unauthenticated public REST API cart endpoints is its primary function. Guest/unauthenticated checkout must be enabled in WooCommerce for an attacker to fully complete an order at a manipulated price; this is a common default configuration but not universal. Sites that have disabled guest checkout reduce the exploitability to cart manipulation only (no completed fraudulent order), but do not eliminate the price injection vector. No specific feature flag, non-default configuration, or privileged access is required.

The CVSS 7.5 High score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the attack's accessibility: unauthenticated, network-reachable, zero-complexity exploitation against a default-configured plugin whose entire value proposition is exposing public REST endpoints. Real-world risk is significant and directly monetizable - an attacker can complete real purchases at near-zero cost, representing immediate financial harm rather than theoretical data exposure. EPSS data was not provided, which is a gap in this analysis. Neither a CISA KEV listing nor public exploit code has been identified at time of analysis, which moderates immediate urgency, but the trivial exploitation bar means risk escalates rapidly once the vulnerability becomes widely known. One data quality issue: WPScan tags this as 'Information Disclosure,' which conflicts with the CVSS vector (C:N, I:H) and description - the actual impact is financial fraud via integrity manipulation, not data exfiltration. Defenders should not be misled by the tag.

An unauthenticated attacker sends a crafted POST request to CoCart's public REST API add-to-cart endpoint, injecting an arbitrarily low price field (e.g., $0.01) for a high-value product. The CoCart plugin forwards this price directly into WooCommerce's cart session without validation, and the attacker proceeds through checkout to complete a legitimate-appearing order at the manipulated total, acquiring physical goods or digital licenses at near-zero cost. No POC has been publicly identified, but exploitation requires only basic HTTP request crafting.