CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.
Explanation of Vulnerability in Simple Terms
CoCart versions before 4.9.0 contain an integrity vulnerability accessible over the network without authentication or user interaction. An attacker can modify data or functionality on an affected site. The vulnerability does not expose sensitive information or cause service disruption. Update to version 4.9.0 or later to resolve this issue.
What an attacker can do
Modify data or functionality on the site without authentication.
Potential impact on your site
Attackers can alter site data or behavior without logging in, potentially affecting store operations or customer data.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
