CVE-2026-10524CWE-472

CVE-2026-10524

High · published August 7, 2026

CVSS v3.1

7.5

EPSS

Percentile

31.0

In the wild

Unconfirmed

What it is

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00382 · 31.0th percentile
Weakness: CWE-472 · External Control of Assumed-Immutable Web Parameter
Published: 2026-08-07T02:16Z

References (1)

https://wpscan.com/vulnerability/99986e13-d38d-4890-b935-9f6fd238ec61/ · [email protected]

EPSS history

Timeline

06 AUG 17:07Z
CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
cvelistv5