CoCart – Headless REST API for WooCommerce <= 4.9.6 - Cross-Site Request Forgery via REST API Nonce Verification Bypass
- ID
- WPSEC-2026-0146
- Plugin
- CoCart – Headless REST API for WooCommerce (cart-rest-api-for-woocommerce)
- Affected
- from 4.0.0 before 4.9.7
- Remediation
- Update to 4.9.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- CoCart – Headless REST API for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The CoCart – Headless REST API for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.0 to 4.9.6. Its REST authentication error check (hooked to rest_authentication_errors at priority 15) returns true for requests the plugin did not authenticate itself. This short-circuits WordPress core's cookie nonce verification (rest_cookie_check_errors) on other REST API endpoints, including the batch endpoint. In 4.9.0 to 4.9.6 this applies to every REST request. In 4.0.0 to 4.8.4 it applies to any request whose URL contains the plugin's route prefix, which an attacker can add to the query string of any REST URL. This makes it possible for unauthenticated attackers to perform REST API actions with the privileges of a logged-in user, such as an administrator creating a new administrator account, by tricking them into clicking a link or visiting a malicious page.
References
- https://wpsec.com/vuln/WPSEC-2026-0146/
- https://plugins.svn.wordpress.org/cart-rest-api-for-woocommerce/tags/4.9.7/
- https://wordpress.org/plugins/cart-rest-api-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS