Vulnerabilities CVE-2026-10524

CVE-2026-10524

High

Open

TLP:CLEAR

CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.

Details

CVSS Score: 7.5
EPSS Score ⓘ: 0.27%

19.2th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Confidence: 90%
Published: Aug 6, 2026
Last Modified: Aug 7, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.