An unauthenticated broken access control vulnerability in the CoCart plugin exposes the headless e-commerce store to unauthorized data manipulation and administrative actions.

The flaw is classified under CWE-862, which refers to missing authorization. Attackers can leverage this to invoke restricted plugin functions without needing valid credentials, effectively bypassing the security model of the e-commerce integration.

A CVSS score of 7.5 reflects the high potential for unauthorized access to e-commerce operations. Exploitation could lead to the compromise of cart data, customer information, or the manipulation of store configurations, causing severe reputational and operational harm.

Immediate Action: Update the CoCart – Headless ecommerce plugin to version 4.9.0 or later to ensure all security checks are properly enforced.

Proactive Monitoring: Review application logs for unexpected API calls or unauthorized requests directed at the CoCart REST API endpoints.

Compensating Controls: Deploy a Web Application Firewall to monitor and restrict access to the plugin API, ensuring that only expected traffic patterns are permitted.

Public Exploit Available: No

The severity of this access control failure mandates an immediate update to version 4.9.0. Organizations relying on CoCart for headless operations should verify their security posture and apply the patch without delay.