CVE-2026-93549
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
Unknown CoCart
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.9.7CoCartCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
Text from CVE List
Affected versions 1
- CoCartaffected: 4.9.0 before 4.9.7CVE List