CVE-2026-93549
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 04, 2026
Vendor
unknown
Description
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.