Unauthenticated Access Control Flaw in CoCart – Headless ecommerce by Patchstack
CVE-2026-59536

7.5HIGH

Key Information:

Vendor

WordPress
Status
Cocart – Headless Ecommerce
Vendor
CVE Published:
27 July 2026

What is CVE-2026-59536?

An unauthenticated broken access control vulnerability has been identified in versions of CoCart - Headless ecommerce up to 4.8.4. This security risk allows unauthorized users to access and manipulate functionalities that should be restricted, potentially compromising sensitive data and actions. It is crucial for users and administrators to update to the latest version to mitigate this risk and ensure the security of their ecommerce applications.

Affected Version(s)

CoCart – Headless ecommerce <= 4.8.4

References

https://patchstack.com/database/wordpress/plugin/cart-res...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

VanTastic | Patchstack Bug Bounty Program
.