CVE-2026-122001

Summary

The Komfortkasse for WooCommerce plugin before 1.4.9 bypasses WordPress nonce verification by overriding its own security checks, allowing unauthenticated attackers to forge requests that appear to come from an authenticated administrator. This enables creation of a new admin account and full site compromise via CSRF.

Exploitability

Exploitation requires tricking an authenticated administrator into visiting a malicious page (e.g., via phishing or compromised site) while logged in, making it moderately difficult due to the need for user interaction and social engineering.

Blast radius

Successful exploitation grants full administrative control of the WordPress site, enabling data exfiltration, malware deployment, defacement, or lateral movement within the hosting environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Komfortkasse for WooCommerce version 1.4.9 or later, which properly enforces nonce validation on REST API endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.