UNKNOWN NVD

CVE-2026-122001

The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonc

The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.

References

https://wpscan.com/vulnerability/e9627207-40ef-4219-8f2c-e3d1581abd2f/

Published: 2026-11-07 · Source: NVD · Feed updated: 2026-11-07

This unknown severity vulnerability was published on 2026-11-07 via NVD.

vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.