CVE-2026-76009: Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint
The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run() function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback set to returntrue and relying on a hardcoded fallback value of token in getoption('nextcarttoken', 'token') when the nextcarttoken option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string token as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to $wpdb->query() and $wpdb->getresults() — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to unlink(), enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the nextcarttoken option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated wp-admin visit, as token generation is deferred to admininit via registersettings().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Next-Cart Store to WooCommerce Migration (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.9.8
Event History
Frequently Asked Questions
Which installations are most likely to be exposed?
Installations are exposed when the nextcart_token option has not been populated in the database. The described condition can occur after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated wp-admin action.
What does an attacker need to exploit the issue?
The attacker does not need authentication or user interaction. They can supply the literal __token__ value to the migration REST endpoint when the token option is unset.
What could successful exploitation allow?
The accessible handlers can execute attacker-controlled SQL through WordPress database functions, including SQL that creates administrator accounts. They can also pass an attacker-controlled path to unlink(), allowing arbitrary file deletion and potential full site takeover.