The CoCart WordPress plugin before version 4.9.0 fails to validate the price supplied via its public REST API. Consequently, any user can submit a price that differs from the actual product value, and the order proceeds at the manipulated total. This flaw allows attackers to obtain goods or services for arbitrary amounts or cause revenue loss to the store owner. The weakness is an input validation flaw consistent with CWE-472.

Any WordPress site that has the CoCart plugin installed and is running a version older than 4.9.0 is affected. The vulnerability targets the public REST API endpoints used to add items to a WooCommerce cart and applies regardless of authentication status.

The CVSS score of 7.5 classifies the issue as high severity. EPSS score of < 1% indicates a very low exploitation probability, but the lack of an authentication requirement means the endpoint is easily reachable. The vulnerability is not listed in CISA's KEV catalog, indicating no confirmed widespread exploitation yet, but the combination of high severity and trivial access vectors maintains a significant risk for e‑commerce sites.