CVE-2026-76009: CWE-287 Improper Authentication in martinnguyen1990 Next-Cart Store to WooCommerce Migration
Description
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option('nextcart_token', '__token__')` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the `nextcart_token` option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated `wp-admin` visit, as token generation is deferred to `admin_init` via `register_settings()`.
CVSS v3.1
8.1high
Affected software
martinnguyen1990
Next-Cart Store to WooCommerce Migration
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76009 describes an authentication bypass vulnerability in the Next-Cart Store to WooCommerce Migration plugin for WordPress, affecting all versions up to and including 3.9.8. The vulnerability arises from the plugin registering a REST route with a permission callback that unconditionally allows access and relying on a hardcoded fallback token '__token__' when the 'nextcart_token' option is not yet set in the database. This fallback is reachable after certain plugin activation scenarios without an authenticated admin visit. Exploitation enables unauthenticated attackers to execute arbitrary SQL queries via $wpdb methods and delete arbitrary files via unlink(), resulting in potential full site compromise.
Potential Impact
An unauthenticated attacker can bypass authentication controls to access privileged migration handlers. This allows arbitrary SQL execution, including the creation of administrator accounts, and arbitrary file deletion. The combined impact can lead to full site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid activating the plugin programmatically or via WP-CLI without a subsequent authenticated admin visit to ensure the token option is properly set. Monitor vendor communications for updates and apply any official patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 08/18/2026
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa0f0a5acd9273b49ccdeda
Added to database: 09/09/2026, 05:37:41 UTC
Last enriched: 09/09/2026, 05:52:09 UTC
Last updated: 10/24/2026, 08:45:12 UTC
Views: 111
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.