CVE-2026-122001
Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.
| Vendor | unknown |
| Product | komfortkasse for woocommerce |
| Published | Nov 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown komfortkasse for woocommerce
Be the first to know when new unknown vulnerabilities affecting unknown komfortkasse for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Komfortkasse for WooCommerce
0 < 1.4.9
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan