{"id":"CVE-2026-122001","published":"2026-11-07T06:16:59.077","lastModified":"2026-11-10T16:28:46.510","description":"The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/e9627207-40ef-4219-8f2c-e3d1581abd2f/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Komfortkasse for WooCommerce plugin before 1.4.9 bypasses WordPress nonce verification by overriding its own security checks, allowing unauthenticated attackers to forge requests that appear to come from an authenticated administrator. This enables creation of a new admin account and full site compromise via CSRF.","exploitability":"Exploitation requires tricking an authenticated administrator into visiting a malicious page (e.g., via phishing or compromised site) while logged in, making it moderately difficult due to the need for user interaction and social engineering.","blast_radius":"Successful exploitation grants full administrative control of the WordPress site, enabling data exfiltration, malware deployment, defacement, or lateral movement within the hosting environment.","remediation":"Upgrade to Komfortkasse for WooCommerce version 1.4.9 or later, which properly enforces nonce validation on REST API endpoints.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","auth-bypass","wordpress","plugin","rest-api"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:53:05.193Z"}}