CVE-2026-76009: Next-Cart WooCommerce Auth Bypass Flaw

CVE-2026-76009 Overview

The Next-Cart Store to WooCommerce Migration plugin for WordPress contains an authentication bypass vulnerability affecting all versions up to and including 3.9.8. The flaw resides in the NCWM_Kitconnect::run() function, which registers the /wp-json/next_cart/v1/migration REST route with permission_callback set to __return_true. Unauthenticated attackers can supply the literal string __token__ as the token to bypass authentication when the nextcart_token option has not yet been written to the database. Successful exploitation enables arbitrary SQL execution, administrator account creation, arbitrary file deletion, and full site takeover [CWE-287].

Critical Impact

Unauthenticated attackers can execute arbitrary SQL, create administrator accounts, and delete arbitrary files on vulnerable WordPress installations.

Affected Products

• Next-Cart Store to WooCommerce Migration plugin for WordPress
• All versions up to and including 3.9.8
• WordPress installations activated via WP-CLI, network activation, or programmatic activation without a subsequent authenticated wp-admin visit

Discovery Timeline

• 2026-09-09 - CVE-2026-76009 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-76009

Vulnerability Analysis

The vulnerability is an authentication bypass in the plugin's REST API migration endpoint. The NCWM_Kitconnect::run() function registers the /wp-json/next_cart/v1/migration route with permission_callback set to __return_true, which permits any request to reach the handler. Access control is delegated to a token check inside the handler itself. The token comparison uses get_option('nextcart_token', '__token__'), which returns the hardcoded fallback string __token__ when the option has not yet been populated in the database.

Once past the token check, the handler passes attacker-controlled input directly to $wpdb->query() and $wpdb->get_results(), enabling arbitrary SQL execution. The same handler passes an attacker-controlled path to unlink(), enabling arbitrary file deletion. Together, these primitives allow administrator account creation and full site takeover.

Root Cause

The root cause is a hardcoded fallback value combined with deferred token generation. Token creation is registered via register_settings() and only fires during admin_init. If the plugin is activated through WP-CLI, network activation, or programmatic activation without a subsequent authenticated visit to wp-admin, the nextcart_token option is never written. Any request supplying __token__ as the token then satisfies the equality check.

Attack Vector

Exploitation requires network access to the WordPress REST API and no authentication or user interaction. An attacker sends a crafted HTTP request to /wp-json/next_cart/v1/migration with the literal token value __token__ and a payload containing SQL statements or a target file path. The plugin executes the SQL through $wpdb or deletes the file via unlink(). See the WordPress Plugin Code Reference Line 120 and WordPress Plugin Code Reference Line 336 for the vulnerable code paths.

Detection Methods for CVE-2026-76009

Indicators of Compromise

• HTTP requests to /wp-json/next_cart/v1/migration containing the literal token value __token__
• Unexpected administrator accounts created in the wp_users and wp_usermeta tables
• Deleted or missing WordPress core, theme, or plugin files not explained by administrator activity
• WordPress options table entries where nextcart_token is absent despite the plugin being active

Detection Strategies

• Inspect web server access logs for POST or GET requests to /wp-json/next_cart/v1/migration from external IP addresses
• Alert on REST API requests that reference the string __token__ in query strings or request bodies
• Monitor the WordPress database for unauthorized changes to wp_users, wp_usermeta, and wp_options
• Correlate plugin activation events from WP-CLI or programmatic sources with subsequent REST API traffic to the migration endpoint

Monitoring Recommendations

• Deploy file integrity monitoring on the WordPress installation directory to detect unexpected unlink() operations
• Enable database query auditing to capture SQL executed via $wpdb->query() and $wpdb->get_results()
• Stream WordPress and web server logs into a centralized analytics platform for real-time correlation and retention
• Track administrator account creation events and alert on accounts created outside change windows

How to Mitigate CVE-2026-76009

Immediate Actions Required

• Deactivate the Next-Cart Store to WooCommerce Migration plugin on all affected WordPress instances until a fixed version is installed
• Audit the wp_users table for unauthorized administrator accounts and remove any that are not attributable to legitimate activity
• Review web server logs for prior requests to /wp-json/next_cart/v1/migration and investigate any that used the __token__ value
• Verify integrity of WordPress core, theme, and plugin files against known-good copies

Patch Information

Refer to the WordPress Plugin Changeset for the vendor fix and upgrade to a version later than 3.9.8 once available. Additional detail is provided in the Wordfence Vulnerability Intel Report.

Workarounds

• Restrict access to /wp-json/next_cart/v1/migration at the web server or WAF layer, blocking all external requests
• After plugin activation, immediately visit wp-admin as an authenticated administrator so that admin_init fires and generates the nextcart_token value
• Block REST API requests that contain the literal string __token__ in parameters or JSON bodies
• Remove the plugin entirely if migration functionality is not currently required

# Example WAF rule to block exploitation attempts
# Deny requests to the vulnerable endpoint containing the hardcoded fallback token
SecRule REQUEST_URI "@contains /wp-json/next_cart/v1/migration" \
    "chain,phase:2,deny,status:403,id:1026760090,msg:'CVE-2026-76009 Next-Cart auth bypass'"
SecRule ARGS|REQUEST_BODY "@contains __token__"