CVE-2026-96837: WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability
Published Sep 30, 2026
·Updated
Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.
Affected Software
1 affected component
CartFlows CartFlows<=3.2.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress CartFlows pluginto a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability is exploitable by an authenticated user with Contributor-level access. No user interaction is required.
2
Can this be exploited remotely, and what is the potential impact?
Yes. The vector is network-accessible, and successful exploitation can lead to remote code execution with high impact to confidentiality, integrity, and availability.
3
Which CartFlows versions are affected?
CartFlows versions up to and including 3.2.0 are affected.