CVE-2026-76009

The Next-Cart Store to WooCommerce Migration plugin for WordPress, in all versions up to and including 3.9.8, allows unauthenticated attackers to bypass authentication on its /wp-json/next_cart/v1/migration REST endpoint because the route has no permission requirement and the handler's token check falls back to the hardcoded value __token__ when the nextcart_token option has never been written to the database. This fallback condition occurs when the plugin is activated via WP-CLI, multisite network activation, or programmatically without a subsequent authenticated visit to wp-admin, since real token generation is deferred to admin_init; sites activated through wp-admin generate a real token and are not exposed. An unauthenticated attacker who supplies the literal string __token__ as the token reaches privileged handlers that pass attacker-controlled SQL directly to $wpdb->query() and $wpdb->get_results() and pass attacker-controlled paths to unlink(). Through these handlers an attacker can execute arbitrary SQL, including creating a new administrator account, and delete arbitrary files, enabling full site takeover. No public proof-of-concept or in-the-wild exploitation is currently known, and the issue is not on the CISA KEV catalog.

What to do: Sites running the plugin should update to a patched release newer than 3.9.8 as soon as the vendor ships one; until then, populate the nextcart_token option by visiting wp-admin once while authenticated after activation, or temporarily deactivate the plugin, since the hardcoded __token__ fallback is the core risk. Because exploitation enables arbitrary SQL execution and file deletion, also check affected sites for unexpected administrator accounts and missing or modified files.