CVE-2026-2019: Cart All In One WooCommerce RCE Flaw

CVE-2026-2019 Overview

The Cart All In One For WooCommerce plugin for WordPress contains a Code Injection vulnerability affecting all versions up to and including 1.1.21. The vulnerability stems from insufficient input validation on the 'Assign page' field, which passes user-controlled input directly to the PHP eval() function. This dangerous code execution pattern allows authenticated attackers with Administrator-level privileges or higher to execute arbitrary PHP code on the server, potentially leading to complete site compromise.

Critical Impact

Authenticated administrators can execute arbitrary PHP code on the server through improper input validation, potentially leading to full site takeover, data exfiltration, and lateral movement within the hosting environment.

Affected Products

• Cart All In One For WooCommerce plugin for WordPress versions ≤ 1.1.21
• WordPress installations using vulnerable plugin versions
• WooCommerce-based e-commerce sites with the affected plugin installed

Discovery Timeline

• 2026-02-18 - CVE-2026-2019 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2019

Vulnerability Analysis

This Code Injection vulnerability (CWE-74) represents a severe security flaw where user-supplied input is passed directly to the eval() function without proper sanitization or validation. The vulnerable code exists in the sidebar-cart-icon.php file at line 245, where the 'Assign page' field value is processed. When an authenticated administrator configures this field with malicious PHP code, the eval() function executes it with the full privileges of the WordPress application.

While the vulnerability requires Administrator-level authentication to exploit, this presents significant risks in scenarios involving compromised admin credentials, malicious insider threats, or social engineering attacks targeting site administrators. The network-accessible nature of the attack vector combined with low attack complexity increases the potential for exploitation once authentication is obtained.

Root Cause

The root cause of this vulnerability is the direct use of the eval() function to process user-controlled input from the 'Assign page' configuration field. The eval() function is inherently dangerous as it executes arbitrary PHP code passed to it as a string. Without proper input validation, sanitization, or the use of safer alternatives, any data reaching this function can be executed as legitimate PHP code. This represents a fundamental violation of secure coding practices where user input should never be passed to code execution functions.

Attack Vector

The attack is executed over the network against WordPress installations running vulnerable versions of the Cart All In One For WooCommerce plugin. An attacker must first obtain Administrator-level credentials through various means such as credential theft, brute force attacks, or social engineering. Once authenticated, the attacker navigates to the plugin's configuration settings and injects malicious PHP code into the 'Assign page' field. When this configuration is saved and the vulnerable code path is executed, the injected PHP code runs on the server with the application's privileges.

The vulnerability can be exploited to install backdoors, create additional admin accounts, exfiltrate sensitive data including customer information and payment details, or use the compromised server as a pivot point for further attacks.

Detection Methods for CVE-2026-2019

Indicators of Compromise

• Unusual PHP code or obfuscated strings present in plugin configuration database entries
• Unexpected modifications to the sidebar-cart-icon.php file or related plugin files
• Web server logs showing suspicious POST requests to WordPress admin settings pages
• New unauthorized administrator accounts or unexpected privilege changes
• Unexpected outbound network connections from the web server

Detection Strategies

• Monitor WordPress database for suspicious content in plugin option values containing PHP code patterns
• Implement file integrity monitoring on the Cart All In One For WooCommerce plugin directory
• Review web application firewall logs for code injection patterns targeting WordPress admin endpoints
• Audit administrator account activity and configuration changes to WooCommerce-related plugins

Monitoring Recommendations

• Enable WordPress audit logging to track all plugin configuration changes
• Configure alerts for modifications to critical plugin files, particularly sidebar-cart-icon.php
• Monitor for unusual eval() function calls in PHP execution logs if available
• Implement real-time alerting on new administrator account creation

How to Mitigate CVE-2026-2019

Immediate Actions Required

• Update the Cart All In One For WooCommerce plugin to a patched version immediately
• Review all administrator accounts for unauthorized access or suspicious activity
• Audit plugin configuration values for any injected malicious code
• Consider temporarily deactivating the plugin if an immediate update is not possible

Patch Information

The vulnerability has been addressed in versions newer than 1.1.21. The WordPress Changeset 3455202 contains the security fix for this vulnerability. Site administrators should update to the latest available version of the plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

Additional technical details about the vulnerability are available in the Wordfence Vulnerability Report. The vulnerable code can be reviewed in the WordPress Plugin Code Repository.

Workarounds

• Restrict WordPress admin access to trusted IP addresses only using .htaccess or firewall rules
• Implement Web Application Firewall (WAF) rules to detect and block code injection attempts
• Enable two-factor authentication for all administrator accounts to reduce credential compromise risk
• Apply principle of least privilege by limiting the number of users with Administrator-level access

# Example .htaccess rule to restrict wp-admin access by IP
<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>