CVE-2026-122001 in Komfortkasse for WooCommerce Plugin
Summary
by MITRE • 11/07/2026
The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability identified in Komfortkasse for WooCommerce prior to version 1.4.9 represents a critical failure in authentication logic within the WordPress REST API implementation. The core technical flaw lies in how the plugin handles request validation, specifically by overriding or bypassing WordPress's native Nonce verification mechanism. In standard WordPress architecture, nonces are cryptographic tokens used to verify that a request originated from an authorized source and has not been tampered with during transmission. By disregarding these built-in security controls, the application fails to distinguish between legitimate administrative actions initiated through the official interface and malicious requests crafted by external actors or injected scripts operating within the context of an authenticated session.
This architectural weakness directly facilitates a severe privilege escalation attack vector known as insecure direct object reference combined with authentication bypass. An attacker who can induce a logged-in administrator to visit a malicious page, typically via Cross-Site Request Forgery techniques, can exploit this flaw without needing valid credentials for that specific action. Because the plugin accepts requests based on flawed validation logic rather than strict nonce verification, any REST API call made in the context of an active administrative session is processed as if it were legitimate. This effectively neutralizes one of WordPress's primary defenses against unauthorized state-changing operations, allowing attackers to manipulate server-side data structures with full administrative privileges.
The operational impact of this vulnerability is catastrophic for site integrity and security posture. The most immediate consequence is the ability for an attacker to create a new user account with administrator-level capabilities. Once such an account is established, the attacker gains persistent access to the entire WordPress installation. This level of control allows for complete website takeover, enabling the exfiltration of sensitive customer data stored in WooCommerce databases, injection of malicious code into themes and plugins, defacement of public-facing content, or use of the compromised server as a pivot point for further network intrusions. The persistence of this access means that even if initial entry vectors are closed, the attacker retains long-term control over the infrastructure unless manually remediated by site owners who may be unaware of the backdoor account creation.
Mitigation strategies must prioritize immediate version updates and enhanced monitoring protocols. Site administrators should upgrade to Komfortkasse for WooCommerce version 1.4.9 or later immediately, as this release corrects the REST API validation logic to properly enforce WordPress nonce requirements. In environments where patching is delayed due to compatibility concerns with other plugins, temporary mitigations include restricting access to the wp-admin directory via IP whitelisting and implementing strict Content Security Policy headers to mitigate Cross-Site Request Forgery vectors that facilitate exploitation of this flaw. Additionally, security teams should audit user accounts for any unauthorized administrator-level entries, particularly those created recently without corresponding legitimate activity logs, as these are indicative of successful exploitation attempts leveraging this specific vulnerability in older versions.