HIGH
CVE-2026-10524
CVSS
7.5
Description
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.
Weakness (CWE)
CWE-472
EPSS Score
0.27%
Probability of exploitation in next 30 days
19.5th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.