Next Cart Store To Woocommerce Migration
Monthly
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.