CVE-2026-122001
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 07, 2026
Vendor
unknown
Description
The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.