CVE-2026-120853: WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability

Q: Which CartFlows versions are affected?

The issue affects CartFlows versions through 3.3.0. The available data does not identify a fixed version.

Q: What access-control condition enables exploitation?

The vulnerability is described as missing authorization caused by incorrectly configured access-control security levels. No further details are provided about the required attacker privileges, affected endpoints, or whether default configurations are vulnerable.

Published Nov 7, 2026

Updated

Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through 3.3.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress CartFlows plugin to a version that resolves this vulnerability.
Fixed in 3.3.1

Event History

Nov 7, 2026

CVE Published

via MITRE·09:13 AM

Data Sourced

via MITRE·09:13 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which CartFlows versions are affected?

The issue affects CartFlows versions through 3.3.0. The available data does not identify a fixed version.

What access-control condition enables exploitation?

The vulnerability is described as missing authorization caused by incorrectly configured access-control security levels. No further details are provided about the required attacker privileges, affected endpoints, or whether default configurations are vulnerable.

CVE-2026-120853: WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which CartFlows versions are affected?

What access-control condition enables exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which CartFlows versions are affected?

What access-control condition enables exploitation?