CVE-2026-76009 describes an authentication bypass vulnerability in the Next-Cart Store to WooCommerce Migration plugin for WordPress, affecting all versions up to and including 3.9.8. The vulnerability arises from the plugin registering a REST route with a permission callback that unconditionally allows access and relying on a hardcoded fallback token '__token__' when the 'nextcart_token' option is not yet set in the database. This fallback is reachable after certain plugin activation scenarios without an authenticated admin visit. Exploitation enables unauthenticated attackers to execute arbitrary SQL queries via $wpdb methods and delete arbitrary files via unlink(), resulting in potential full site compromise.

An unauthenticated attacker can bypass authentication controls to access privileged migration handlers. This allows arbitrary SQL execution, including the creation of administrator accounts, and arbitrary file deletion. The combined impact can lead to full site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid activating the plugin programmatically or via WP-CLI without a subsequent authenticated admin visit to ensure the token option is properly set. Monitor vendor communications for updates and apply any official patches promptly once released.