Cartflows CVE-2026-39477

Exploitation requires an authenticated WordPress user account with any registered role (subscriber, contributor, author, editor, or lower privilege) on the target WordPress installation running CartFlows ≤2.2.3. CartFlows must be installed and activated. The vulnerability does NOT require administrator access, special plugin configuration, or network-level conditions beyond standard WordPress HTTP/HTTPS access. No special authorization bypass techniques or chaining with other vulnerabilities is necessary if CartFlows is misconfigured to allow authenticated users unrestricted access to protected functions.

CVSS 4.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network-accessible exploitation requiring low complexity and prior authentication, with integrity impact only (modification capability) and no confidentiality or availability impact. EPSS 0.02% (4th percentile) signals very low exploitation probability in the real world, suggesting either limited attacker incentive, difficult exploitation chains, or narrow applicability. The absence of KEV status and no confirmed POC further reduce assessed risk. However, authentication requirement (PR:L) significantly lowers risk compared to unauthenticated authorization flaws. For WordPress deployments, the real-world impact depends heavily on threat actor access to WordPress user accounts; in multi-user WordPress sites or those with loose access controls, an attacker with subscriber or contributor role could escalate permissions to modify store configurations, funnels, or customer data. This is a low-priority remediation candidate unless the affected WordPress instance faces insider threats or account compromise risk.

An authenticated WordPress contributor or subscriber on a CartFlows-enabled e-commerce site exploits the missing authorization check to directly access admin-only CartFlows API endpoints or settings pages. The attacker modifies funnel configurations, disables checkout steps, or alters product pricing without holding the administrator role, causing business disruption or financial loss. No public exploit code is required; the attacker manually crafts HTTP requests or uses WordPress admin interface inspection to discover vulnerable endpoints.