CVE-2026-10524 - Vulnerability Details - OpenCVE

The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00271.

Exploitation poc

Automatable yes

Technical Impact partial

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://wpscan.com/vulnerability/99986e13-d38d-4890-b935-9f6fd238ec61/

History

Fri, 07 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-472
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 06 Aug 2026 23:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Thu, 06 Aug 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.
Title		CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
References		https://wpscan.com/vulnerability/99986e13-d38d-4890-b935-9f6fd238ec61/
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-08-06T17:07:30.648Z

Updated: 2026-08-07T14:10:32.736Z

Reserved: 2026-06-01T09:02:04.498Z

Link: CVE-2026-10524

Vulnrichment

Updated: 2026-08-07T14:10:28.272Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-06T23:30:05Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10524", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-06-01T09:02:04.498Z", "datePublished": "2026-08-06T17:07:30.648Z", "dateUpdated": "2026-08-07T14:10:32.736Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-08-06T17:07:30.648Z"}, "title": "CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation", "problemTypes": [{"descriptions": [{"description": "CWE-472 External Control of Assumed-Immutable Web Parameter", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "CoCart", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "4.9.0"}], "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins"}], "descriptions": [{"lang": "en", "value": "The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals."}], "references": [{"url": "https://wpscan.com/vulnerability/99986e13-d38d-4890-b935-9f6fd238ec61/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "value": "hoangphuong", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-472", "lang": "en", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T14:10:10.431830Z", "id": "CVE-2026-10524", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:10:32.736Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10524", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-06-01T09:02:04.498Z", "datePublished": "2026-08-06T17:07:30.648Z", "dateUpdated": "2026-08-07T14:10:32.736Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-08-06T17:07:30.648Z"}, "title": "CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation", "problemTypes": [{"descriptions": [{"description": "CWE-472 External Control of Assumed-Immutable Web Parameter", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "CoCart", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "4.9.0"}], "defaultStatus": "unaffected", "collectionURL": "https://wordpress.org/plugins"}], "descriptions": [{"lang": "en", "value": "The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals."}], "references": [{"url": "https://wpscan.com/vulnerability/99986e13-d38d-4890-b935-9f6fd238ec61/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "value": "hoangphuong", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10524", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T14:10:10.431830Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-472", "description": "CWE-472 External Control of Assumed-Immutable Web Parameter"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:10:28.272Z"}}]}}