Executive brief
The Next-Cart Store to WooCommerce Migration plugin for WordPress allows unauthenticated users to bypass authentication and gain unauthorized access to privileged migration functions. Attackers can exploit this vulnerability to create administrator accounts, execute arbitrary SQL commands, delete files, and fully compromise a WordPress site.
Technical details
The vulnerability is an authentication bypass in the plugin's REST API endpoint `/wp-json/next_cart/v1/migration`. The endpoint is registered with `permission_callback` set to `__return_true` (allowing all access), and relies on a hardcoded fallback token value `__token__` in `get_option('nextcart_token', '__token__')` when the option has not yet been written to the database. Unauthenticated attackers can supply the literal string `__token__` as the token to bypass authentication. Once authenticated, the vulnerability enables arbitrary SQL injection through functions that pass attacker-controlled input directly to `$wpdb->query()` and `$wpdb->get_results()`, as well as arbitrary file deletion via an unsanitized path parameter to `unlink()`. The hardcoded fallback is reachable in scenarios where the plugin is activated via WP-CLI, network activation, or programmatic methods without a subsequent authenticated wp-admin visit, since token generation is deferred until the `admin_init` hook. Patches are available in versions after 3.9.8.
Affected products
- Next-Cart Store to WooCommerce Migration up to and including 3.9.8
Timeline
- 2026-09-09: disclosed: CVE-2026-76009 published