Description

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-06T22:16:42.537Z",
  "pubdate": "2026-08-06T22:16:42.537Z",
  "executiveSummary": "The CoCart WordPress plugin prior to version 4.9.0 suffers from an improper input validation vulnerability within its public REST API endpoints. This security flaw allows unauthenticated remote attackers to bypass pricing logic by supplying arbitrary price values when adding items to the cart. Consequently, malicious actors can manipulate product totals and successfully complete fraudulent WooCommerce checkout transactions with heavily discounted or zero-cost orders, posing a severe financial and operational risk to affected e-commerce platforms. The exploitation of this vulnerability requires network access to the exposed REST API endpoints without requiring prior authentication or privileged access roles.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation of user-supplied price parameters processed by the CoCart REST API endpoints when adding items to the cart. Specifically, the application blindly trusts the price value provided in the incoming HTTP request payload instead of cross-referencing and validating it against the authoritative product price stored in the database.\nDuring a typical attack flow, an unauthenticated attacker sends a crafted HTTP POST request to the vulnerable public CoCart REST API endpoint responsible for adding products to the shopping cart. The payload includes standard product identifiers alongside a maliciously manipulated price parameter set to an arbitrary value, such as a fraction of the actual cost or zero.\nUpon receiving the request, the vulnerable component processes the item addition without performing integrity checks or querying the underlying WooCommerce product object to verify the legitimate price. The manipulated price is subsequently injected directly into the active session's cart data structure, overriding the legitimate database-derived pricing.\nAs the user proceeds through the checkout flow, WooCommerce calculates the final order total based on the poisoned cart data supplied by CoCart. The attacker can then finalize the payment process and complete the order at the manipulated total.\nThe vulnerability affects the CoCart WordPress plugin across all versions prior to 4.9.0. Exploitation is fully unauthenticated, requires exposure of the REST API over the network, and results in direct financial loss and integrity compromise of WooCommerce order processing."
}