CVE-2026-10524
High · 7.5CVSS
7.5
EPSS
—
Published
Aug 6, 2026
CISA due date
—
The record
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-84762 Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. CWE-472
- CVE-2026-77999 Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to… CWE-472
- CVE-2026-84654 In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in… CWE-472
- CVE-2026-77794 The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied… CWE-472
- CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms <… CWE-472
- CVE-2026-15045 The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a… CWE-472
- CVE-2026-16620 The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce… CWE-472
- CVE-2026-16067 The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not… CWE-472