CVE-2026-96837

HighCVSS 8.8

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

Remote Code Execution (RCE) vulnerability exploitable by users with Contributor role in CartFlows plugin up to version 3.2.0. A low-privileged user can execute code on the server.

Risk Assessment

Risk of full server compromise, data theft, or malware installation.

Recommendation

Update the CartFlows plugin to the latest version with the security fix and restrict access to Contributor accounts.

Other vulnerabilities in CartFlows

CVE-2026-39477Medium
The CartFlows WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.2.3.

Original NVD description (English source)

Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS