CVE-2026-122001 · Package
NO FIX YET · SEE WHAT TO DO
The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 accepts REST API requests without properly checking they are authentic. A forged request sent from a logged-in administrator's browser can create a new administrator account, giving the attacker full control of the site.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Komfortkasse for WooCommerce WordPress plugin before 1.4.9 are exposed. The attack needs a logged-in administrator to visit a malicious page in the same browser, so sites where administrators do not browse the web while logged in carry less risk, but the plugin should still be updated.
Not affected if plugin-not-installed, version-1.4.9-or-later
Who cares komfortkasse, self-hosted, woocommerce, wordpress
wp-content/plugins/.1.4.9 or later (the fixed version named in the source).The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.