CVE-2026-93549 in CoCart Plugin
Summary
by MITRE • 10/04/2026
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in CoCart versions prior to 4.9.7 stems from a critical misconfiguration of the WordPress REST API authentication mechanisms. Specifically, the plugin registers an authentication filter without properly scoping it to its own specific endpoints. In standard WordPress development practices, plugins that interact with the REST API must ensure their custom logic does not interfere with core security features unless explicitly intended for those specific routes. By applying a broad or improperly scoped filter, CoCart inadvertently disables the nonce verification process for all REST API requests handled by the server during the execution of its code path. This oversight effectively strips away one of WordPress's primary defenses against cross-site request forgery attacks across the entire application interface rather than just within the plugin's designated functionality.
This architectural flaw creates a severe security gap that allows attackers to exploit authenticated sessions belonging to high-privilege users, such as administrators. Because the nonce protection is disabled for all routes during the affected operations, an attacker can craft malicious requests that appear legitimate to the server. The most critical impact of this vulnerability is the ability to create new administrator accounts without requiring additional authentication steps beyond a valid session cookie from an existing admin user. This means that if an administrative user visits a page controlled by an attacker or clicks on a manipulated link, their browser will automatically send the necessary cookies and headers to execute arbitrary REST API calls. The attacker can thus escalate privileges remotely, gaining full control over the WordPress installation without needing to steal passwords or exploit other vulnerabilities in the authentication system itself.
From a classification perspective, this issue aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF). Furthermore, it relates to CWE-694, indicating use of multiple inconsistent control mechanisms, as the plugin's implementation conflicts with WordPress core security expectations. In terms of offensive tactics, this vulnerability facilitates actions consistent with MITRE ATT&CK technique T1078, specifically Valid Accounts and Privilege Escalation phases, where an attacker leverages existing credentials to gain higher-level access. The lack of proper endpoint scoping also touches upon CWE-942, which involves the over-permissioning of components by exposing sensitive functionality or security controls unnecessarily broadly.
The operational impact is profound, as it compromises the integrity and confidentiality of the entire WordPress environment. Once an attacker creates a new administrator account through this CSRF vector, they can install malicious plugins, modify site content, exfiltrate database information, or pivot to further attacks against backend systems connected to the web application. This represents a complete compromise of administrative control, which is typically considered the highest level of access in WordPress ecosystems. The ease of exploitation means that even users with minimal security awareness are at risk if they interact with maliciously crafted content while logged into their admin dashboard.
Mitigation strategies must focus on immediate remediation and future defensive coding practices. The primary solution is to upgrade CoCart to version 4.9.7 or later, where the developers have corrected the scope of the REST API authentication filter to ensure it only applies to intended endpoints without disrupting core nonce verification for other routes. For organizations unable to update immediately due to compatibility constraints, temporary workarounds may include restricting access to the WordPress admin area via IP whitelisting if feasible, or implementing a Web Application Firewall rule that specifically blocks suspicious POST requests targeting REST API endpoints with missing or invalid nonces. Additionally, developers should audit all custom plugins for similar patterns where authentication filters are applied globally rather than scoped locally, ensuring adherence to WordPress coding standards that mandate strict separation of concerns and preservation of core security mechanisms. Regular security audits and static code analysis tools configured to detect improper nonce usage can help prevent recurrence in future development cycles.