Vulnerabilities / CoCart – Headless REST API for WooCommerce
CoCart – Headless REST API for WooCommerce vulnerabilities
Advisories WPSec published for CoCart – Headless REST API for WooCommerce. Other sources may list more. Its attack surface: CoCart – Headless REST API for WooCommerce on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-01 | WPSEC-2026-0146 | CoCart – Headless REST API for WooCommerce <= 4.9.6 - Cross-Site Request Forgery via REST API Nonce Verification Bypass | High 8.8 | 4.9.7 |
License: CC BY 4.0