CVE-2026-66465

The Cartify plugin versions up to 1.3.0.1 contain an unauthenticated Broken Authentication vulnerability. An attacker without logging in can bypass authentication mechanisms and gain access to user or administrator accounts.

An attacker can take over user or administrator accounts, potentially leading to data theft, unauthorized transactions, or full site compromise. This may also undermine customer trust.

Update the Cartify plugin to the latest version that includes the fix. If not available, implement additional authentication mechanisms such as multi-factor authentication and monitor login logs.