Cocart
Monthly
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.