Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-76009 – Unauthenticated Authentication Bypass to SQLi/RCE – Next-Cart Store to WooCommerce

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-76009 is a critical authentication bypass vulnerability (CWE-287: Improper Authentication) affecting the "Next-Cart Store to WooCommerce Migration" WordPress plugin, developed by martinnguyen1990. The flaw resides in the plugin’s REST migration endpoint, which falls back to a hardcoded secret token when no token has yet been generated on the site, allowing unauthenticated attackers to reach privileged migration handlers. The issue carries a CVSS v3.1 base score of 8.1 (High) and can lead to arbitrary SQL execution, arbitrary file deletion, and full site takeover.

Technical details

  • Root cause: The plugin’s REST API migration endpoint validates requests against a secret stored in the nextcart_token WordPress option. If this option has never been initialized (e.g., on a freshly installed site or one where the migration wizard was never run), the code falls back to a hardcoded literal value, __token__, instead of rejecting the request or requiring a properly generated secret.
  • Trigger conditions: Exploitation requires only that the target site has the plugin installed/active and has not yet generated a real nextcart_token value in the database — a common state on default or freshly deployed installations.
  • Attack vector: Network-based and unauthenticated (AV:N, PR:N, UI:N). An attacker sends a crafted REST API request supplying the literal string __token__ as the authentication token.
  • Impact: Successful exploitation grants access to backend migration handlers that expose arbitrary SQL query execution and arbitrary file deletion functionality. This can be leveraged to compromise the WordPress database, delete critical site files, create rogue administrator accounts, and ultimately achieve full site takeover. Confidentiality, integrity, and availability are all rated High.

Affected software

  • Next-Cart Store to WooCommerce Migration (WordPress plugin) — versions up to and including 3.9.8

Severity

  • CVSS v3.1 Base Score: 8.1 (High)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

  • Immediate: Upgrade the Next-Cart Store to WooCommerce Migration plugin to version 3.9.9 or later, which removes the insecure hardcoded fallback token and requires a properly generated migration secret.
  • If unable to patch immediately:
    • Deactivate the plugin until the update can be applied, especially if the migration feature is not actively in use.
    • Verify that a unique nextcart_token value has been generated/exists in the site’s WordPress options table, and rotate it after patching.
    • Restrict or firewall access to the plugin’s REST API migration endpoints at the network/WAF layer for sites that cannot be updated immediately.
    • Monitor site logs for unexpected REST API requests referencing the plugin’s migration endpoints and for unauthorized administrator account creation.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge