The CoCart WordPress plugin versions prior to 4.9.0 contain a security flaw classified as CWE-472 (External Control of Assumed-Immutable Web Parameter). Specifically, the plugin fails to validate the price parameter supplied by users when adding products to the cart through its public REST API. This lack of validation allows unauthenticated attackers to set arbitrary product prices, potentially completing orders with manipulated totals in WooCommerce.

An attacker can exploit this vulnerability to set arbitrary prices for products in the cart without authentication, potentially purchasing items at significantly reduced prices or even free. This compromises the integrity of the e-commerce transaction process, leading to financial loss for the affected merchant. The vulnerability does not impact confidentiality or availability but has a high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST API endpoints if possible or implement additional server-side validation to verify product prices before processing orders.