CVE-2026-10524
CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.
| Vendor | unknown |
| Product | cocart |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown cocart
Be the first to know when new high vulnerabilities affecting unknown cocart are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / CoCart
0 < 4.9.0
References
Credits
hoangphuong WPScan