CVE-2026-93549 CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
An attacker can create an administrator account via CSRF by exploiting a REST API authentication bypass in the CoCart WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-93549?
CVE-2026-93549 is a high-severity vulnerability in Unknown CoCart, published on 4 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
Weakness: CWE-352
Which versions are affected by CVE-2026-93549?
How do I fix CVE-2026-93549?
No fix has been published for CVE-2026-93549 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93549 being exploited?
There is no known exploitation of CVE-2026-93549 in the wild and no public exploit code.
Sources
Also known as GHSA-9p8w-fmwq-692f.