CoCart v4.9.5 is a small, focused security release. If you’re wondering whether this needs careful staging before you roll it out — it doesn’t. Read on for what changed and why it’s safe to update today.
What the Security Patch Does
This release hardens how the cart session handler validates the cart key, however it’s supplied — whether as a request parameter cart_key or via the CoCart-API-Cart-Key header — ensuring a cart can only be loaded by the account it actually belongs to. We recommend updating to this release as soon as possible.
Why This Matters
CoCart’s decoupled session model means a request can identify which cart to load by passing a cart_key, rather than relying on a cookie. That’s what makes CoCart work for native apps, static frontends, and anything else that can’t carry a browser cookie along for the ride. This release tightens the validation around that mechanism, so a cart can only ever be loaded by the account it belongs to.
Why You Can Update Without Fear
We know “security patch” can read as a signal to slow down and test extensively before touching production. For this release, that caution isn’t necessary, and here’s why:
- Nothing about your integration changes. If your frontend only ever requests its own cart — which is how every CoCart integration we’re aware of already works — this update is invisible to it. There’s no new required parameter, no changed response shape, no header you need to add.
- Guest-to-account cart transfer still works exactly the same. Logging a guest in and having their cart carry over to their account is unaffected — that flow was never what this change touches.
- Admin and POS-style cart access is preserved. If you build on top of CoCart’s documented support for privileged cart lookups, that continues to work as before.
- It’s additive validation, not a behavior change to any documented, supported use of
cart_key. The only thing that’s different is a case that was never a supported or intended use of the parameter in the first place.
In short: this is the kind of update you apply as part of your normal update cycle, not one that needs a staging-environment fire drill first.
How to Update
Update through the WordPress plugin updater as usual, or via WP-CLI:
wp plugin update cart-rest-api-for-woocommerce
No configuration changes, database migrations, or code changes on your end are required.