EUVD-2026-92075
GHSA-9p8w-fmwq-692f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network CSRF by an unauthenticated attacker (PR:N) requiring an admin victim to visit a page (UI:R); rogue-admin creation yields full C:H/I:H/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
AnalysisAI
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a vulnerable CoCart plugin installed and active on a WordPress site, version 4.9.0 up to but not including 4.9.7; and (2) an administrator who is currently authenticated to that site being induced to visit an attacker-controlled page (UI:R) so the forged request rides their live session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) describes a network-reachable flaw requiring no attacker privileges but requiring victim interaction (UI:R): a logged-in administrator must be lured to an attacker-controlled page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update the CoCart plugin to 4.9.7 or later, the first version outside the affected 4.9.0-4.9.6 range; patch availability is confirmed by the vendor via the WPScan advisory at https://wpscan.com/vulnerability/77f413f6-8753-4c83-8623-00ad7a1dcaff/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations for CoCart plugin versions 4.9.0 through 4.9.6 and update them to CoCart 4.9.7 or later; if immediate patching is not possible, disable the plugin or restrict administrator sessions while advising administrators to avoid untrusted sites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today