Next-Cart WooCommerce Migration EUVD-2026-74689

Exploitation requires that the nextcart_token WordPress database option has not yet been written to the wp_options table. This state persists whenever the plugin was activated via WP-CLI (wp plugin activate), via WordPress multisite network activation from the network admin dashboard, or via programmatic activation through code, AND no authenticated administrator has subsequently visited any wp-admin page after activation - because token generation is deferred to the admin_init hook and only fires during authenticated backend page loads. On sites where an administrator visited wp-admin after activation (normal interactive installs), the fallback is not reachable and the site is not vulnerable. There is no other authentication required - once the uninitialized condition is present, exploitation is fully unauthenticated over the public WordPress REST API with no user interaction. The limiting factor is therefore the specific activation pathway: interactive manual activation via wp-admin followed immediately by any admin page load protects the site; automated/headless activation does not.

The NVD-assigned CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1) is well-calibrated. The AC:H reflects the specific prerequisite - the nextcart_token database option must not yet have been written - rather than technical complexity in the exploit itself; once conditions are met, the attack is trivially simple (send a single HTTP request with a known static string). The critical nuance for defenders is that this condition is not rare in practice: automated WordPress deployments, CI/CD pipelines using WP-CLI, and multisite network activations routinely activate plugins without an intervening authenticated admin visit, leaving sites permanently vulnerable until a human visits wp-admin. The impact triad (C:H/I:H/A:H) is fully justified: SQL injection enables admin account creation (full confidentiality and integrity compromise), while unlink() with attacker-controlled paths can destroy WordPress core files or wp-config.php (availability). No EPSS data was provided, and no CISA KEV listing exists at time of analysis. However, the attack surface is highly automatable once a target is identified - a single unauthenticated HTTP request suffices - which increases opportunistic risk. Real-world priority should be HIGH for any deployment that activated this plugin without an immediate subsequent wp-admin login.

An attacker targeting a WordPress site running this plugin - installed via WP-CLI or network activation without a subsequent admin login - sends a single HTTP POST request to https://target.example.com/wp-json/next_cart/v1/migration with the token value __token__, which matches the hardcoded database-option fallback. The request body contains attacker-controlled SQL passed to $wpdb->query(), creating a new WordPress administrator account. The attacker then logs in as administrator, installs a backdoor plugin, and achieves persistent server-level code execution. Alternatively, the attacker passes a path such as ../wp-config.php to the unlink() handler, destroying the site's database credentials and taking the site offline.