Price Manipulation Vulnerability in CoCart WordPress Plugin
CVE-2026-10524

7.5HIGH

Key Information:

Vendor

WordPress
Status
Cocart
Vendor
CVE Published:
6 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-10524?

The CoCart WordPress plugin, especially in versions prior to 4.9.0, has a significant flaw where it does not properly validate user-supplied price values against the actual prices of products. This weakness allows unauthenticated users to bypass typical security measures, enabling them to set arbitrary prices when adding products to their cart via public REST API endpoints. Consequently, this can lead to a situation where users can complete WooCommerce orders at manipulated prices, raising serious concerns about potential financial loss and exploitation.

Affected Version(s)

CoCart 0 < 4.9.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-10524 - Proof of Concept

References

https://wpscan.com/vulnerability/99986e13-d38d-4890-b935-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hoangphuong
WPScan
.