What happened
A security researcher, Naoki Kawahigashi, reported that CoCart’s REST authentication check was not properly scoped to CoCart’s own endpoints. In some configurations this allowed WordPress’s own request verification to be bypassed on other REST routes.
We want to thank Naoki for the responsible disclosure that let us fix this before it was made public.
The fix itself is small: CoCart’s authentication check now only answers for requests CoCart itself has authenticated, leaving every other request to WordPress core’s normal verification, exactly as it should have all along.
While we recommend that you update to the latest release, we have also made sure that releases that were affected have been patched with the fix too.
Why we’re backporting
Not every store running v4.9.0 through v4.9.6 can update to v4.9.7 immediately. Some are pinned to an exact version via Composer, some are waiting on a maintenance window, and some simply haven’t updated yet. None of them should be left exposed in the meantime, so the fix has been applied directly to each of those releases, both on GitHub and on WordPress.org.
Affected and fixed versions
If you’re running any of the following, you’re already covered once you reinstall that same version. You no longer have to jump to v4.9.7 just to be safe, though we still recommend it.
| Version | Status | Release |
|---|---|---|
| v4.9.0 | Patched in place | GitHub |
| v4.9.1 | Patched in place | GitHub |
| v4.9.2 | Patched in place | GitHub |
| v4.9.3 | Patched in place | GitHub |
| v4.9.4 | Patched in place | GitHub |
| v4.9.5 | Patched in place | GitHub |
| v4.9.6 | Patched in place | GitHub |
| v4.9.7 | Recommended | GitHub · WordPress.org |
What you should do
- Best option: update to
4.9.7the normal way, from your WordPress dashboard. - Installed via Composer (WPackagist)? Composer caches downloaded zips, so clear the cache first and then reinstall to pull the patched copy of your pinned version:
composer clear-cache composer reinstall wpackagist-plugin/cart-rest-api-for-woocommerce - Downloaded from GitHub? The zip and tar.gz attached to each release above have been replaced with patched copies. Download again if you got yours before 30th September 2026.
- Rolling back for any reason? Every version from v4.9.0 onward on WordPress.org now carries the fix, so rollback tools install the patched code. There’s no vulnerable version left to roll back into.
Timeline
- Vulnerability reported. Naoki Kawahigashi disclosed the issue to the CoCart security team.
- Fix developed and verified. Patch written, covered by new regression tests, and confirmed against every affected release.
- Confirmed fix by reporter. Naoki reviewed a candidate build and confirmed the fix holds.
- 30th September 2026 · v4.9.7 released. The fix shipped as the current stable version.
- 30th September 2026 · Backports applied. The same fix applied to v4.9.0 through v4.9.6 on GitHub and WordPress.org.
Credit
Thank you to Naoki Kawahigashi for reporting this responsibly and giving us the time to fix it properly across every affected release.
Questions about this advisory? Reach the CoCart team through our usual support channels. As always, every release is open source and auditable on GitHub.