Komfortkasse WooCommerce CVE-2026-122001

Exploitation requires a site running Komfortkasse for WooCommerce before 1.4.9 AND a currently logged-in WordPress administrator who is induced to trigger an attacker-forged REST API request from their browser (the CVSS UI:R and the description's 'forged in a logged-in administrator's browser'). The specific defect is that the plugin's REST API request handling overrides WordPress's native nonce verification, so no valid nonce or CSRF token is needed for the forged request to be accepted. Limiting factors: the attacker holds no privileges of their own (PR:N), but success is gated on social-engineering an authenticated admin into interacting (UI:R), on the victim having an active admin session, and on the vulnerable plugin version being installed; SSVC marks the attack non-automatable. There is no mention of a non-default configuration being required.

This is a CWE-352 cross-site request forgery flaw in which the plugin overrides WordPress's own nonce verification, so the real-world risk hinges on tricking a logged-in administrator rather than on any attacker-held access. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) and the 8.8 base score reflect network reach and total CIA impact, but the UI:R component is the decisive limiter: exploitation requires an authenticated administrator to be lured into triggering the forged request. Signals are consistent and point to a genuine but not emergency priority: EPSS is very low (0.10%, 1st percentile), there is no CISA KEV listing, and the SSVC decision records Exploitation: none and Automatable: no - meaning no observed exploitation and no reliable mass-automation - while Technical Impact: total aligns with the full-site-takeover outcome. The POC is a reference only, not verified as working exploit code, so POC availability must not be read as active exploitation. The vuln.today Decision label is this_week, which is proportionate: high impact and a available patch, but mitigated by the required admin interaction and low automatability. Authentication requirement is confirmed as PR:N (the attacker needs no account of their own) from the provided CVSS vector; however, successful exploitation still depends on an authenticated administrator victim, which the CVSS vector encodes as UI:R rather than PR.

An attacker crafts a malicious web page or email that silently issues a forged REST API request; when a logged-in site administrator visits it in the same browser, the plugin accepts the request despite the missing/overridden nonce and provisions a new administrator account the attacker controls, yielding full site takeover. Because the CVSS vector is AV:N/AC:L but UI:R, the attack is low-complexity and network-delivered yet depends on the admin being induced to interact. A public PoC reference exists (WPScan/VulDB); it is not verified as working exploit code.