{"affected":[{"defaultStatus":"unaffected","product":"Komfortkasse for WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.4.9","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-122001","cwes":["CWE-352"],"description":"The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress's own nonce verification so that a request forged in a logged-in administrator's browser is accepted, which can be used to create a new administrator account and fully take over the site.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/e9627207-40ef-4219-8f2c-e3d1581abd2f/"}],"kev":null,"metrics":[],"modifiedAt":1794031229393,"publishedAt":1794031229393,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/e9627207-40ef-4219-8f2c-e3d1581abd2f/"}],"remediation":[],"revision":"36b4d9f8b0257d1f4951fadd2baba7acde5e929b3c12b7d360c822b4ec1754f4","sources":[{"modifiedAt":1794031229393,"name":"CNA: WPScan","retrievedAt":1794031734272,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122001"}],"ssvc":null,"status":"published","title":"Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF","updatedAt":1794031734272}