Threats tagged 'ghsa-9p8w-fmwq-692f'

CVE-2026-93549 is a high-severity cross-site request forgery (CSRF) vulnerability in the CoCart WordPress plugin versions 4.9.0 through 4.9.6. The plugin improperly scopes its REST API authentication filter, disabling WordPress core's REST nonce protection for all routes. This flaw allows an attacker to exploit a logged-in administrator's session to create a new administrator account via CSRF.