PULSE
ESPT
FEED
ransommetaencryptor reclama a Christie Digital Systems · US · Technologyransommetaencryptor reclama a Daeah E&C · KR · Manufacturingransommetaencryptor reclama a DAEWON Chemical · KR · Manufacturingransommetaencryptor reclama a Wooshin Systems · KR · Technologyransommetaencryptor reclama a Proterial America, Ltd. · US · Manufacturingransommetaencryptor reclama a Hyundai E&C · KR · Manufacturingransommetaencryptor reclama a Pekin Insurance · US · Financial Servicesransomn0n reclama a Staples, Inc. / SBD Inc. · US · Retail & E-Commerceransomn0n reclama a Lampenwelt GmbH · DE · Retail & E-Commerceransomn0n reclama a Infutor Data Solutions · US · Technologyransomn0n reclama a Higginbotham · US · Professional Servicesransomrhysida reclama a Treuhand & Immobilien Abt AG · CH · Financial Servicesransomwhitearmor reclama a maersk · DK · Transportationransomqilin reclama a Acondistec · DE · Manufacturingransommetaencryptor reclama a Christie Digital Systems · US · Technologyransommetaencryptor reclama a Daeah E&C · KR · Manufacturingransommetaencryptor reclama a DAEWON Chemical · KR · Manufacturingransommetaencryptor reclama a Wooshin Systems · KR · Technologyransommetaencryptor reclama a Proterial America, Ltd. · US · Manufacturingransommetaencryptor reclama a Hyundai E&C · KR · Manufacturingransommetaencryptor reclama a Pekin Insurance · US · Financial Servicesransomn0n reclama a Staples, Inc. / SBD Inc. · US · Retail & E-Commerceransomn0n reclama a Lampenwelt GmbH · DE · Retail & E-Commerceransomn0n reclama a Infutor Data Solutions · US · Technologyransomn0n reclama a Higginbotham · US · Professional Servicesransomrhysida reclama a Treuhand & Immobilien Abt AG · CH · Financial Servicesransomwhitearmor reclama a maersk · DK · Transportationransomqilin reclama a Acondistec · DE · Manufacturing
← All CVEs
CVE WatchNov 7, 2026

CVE-2026-122001

The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 7, 2026 · Last modified: Nov 7, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.

Official references
Related CVEs

No related CVEs by CWE or product.