CVE-2026-93549

Summary

The flaw in CoCart WordPress plugin before 4.9.7 allows an attacker to perform a cross-site request forgery (CSRF) attack, creating a new administrator account using a logged-in administrator's session, due to the lack of REST API authentication scope.

Exploitability

Exploitation is relatively straightforward as it requires an attacker to trick a logged-in administrator into performing an unauthorized action via a forged request.

Blast radius

If exploited, the attacker could gain full administrative access to the WordPress site, leading to potential data breaches and unauthorized actions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to CoCart 4.9.7 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.