CVE-2026-93549

Published 4 October 2026 · tracked since 4 October 2026

Description

The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-86817
• CVE-2026-97332
• CVE-2026-17005
• CVE-2026-104119
• CVE-2026-104118
• CVE-2026-105123 HIGH 8.8
• CVE-2026-105124 MEDIUM 6.1
• CVE-2026-105125 LOW 3.7
• CVE-2026-105118 MEDIUM 4.7
• CVE-2026-97873

→ Open the live CVE board · all tools