Cocart Headless Ecommerce

1 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2026-59536 Jul 27, 13:59 HIGH This Week

Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.

WordPress Authentication Bypass Wordpress Plugin Cocart Headless Ecommerce

NVD

CVSS 3.1

7.5

EPSS

0.2%

CVE-2026-59536

EPSS 0% CVSS 7.5

HIGH This Week

Unauthenticated broken access control in CoCart - Headless ecommerce plugin for WordPress versions up to 4.8.4 allows remote attackers to bypass authentication and modify ecommerce data with high integrity impact. Attackers require no user interaction or privileges, and the vulnerability is reachable over the network. No active exploitation (not in CISA KEV) or public exploit code has been identified at this time, and EPSS data is unavailable.

WordPress Authentication Bypass Wordpress Plugin +1

NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy