The CoCart WordPress plugin versions prior to 4.9.0 do not validate user-supplied price values against the actual product prices when items are added to the cart via a public REST API endpoint. This lack of validation allows unauthenticated attackers to set arbitrary prices for products, potentially completing WooCommerce orders with manipulated totals. The vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter) and has a CVSS v3.1 score of 7.5, indicating high severity. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An attacker can manipulate the price of products added to the cart through the public REST API without authentication. This can lead to financial loss by allowing orders to be completed at incorrect, attacker-controlled prices. The integrity of the e-commerce transaction process is compromised, but there is no indication of confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST API endpoints if possible, and monitor for unusual order activity. Avoid relying on client-supplied price data for order processing.