WordPress · Cart All In One For Woocommerce · CVE-2026-2019
**Name of the Vulnerable Software and Affected Versions**
Cart All In One For WooCommerce versions prior to 1.1.22
**Description**
The Cart All In One For WooCommerce plugin for WordPress is susceptible to code execution. This occurs because of inadequate input validation on the 'Assign page' field, which is directly passed to the `eval()` function. This allows authenticated attackers with Administrator-level access or higher to execute arbitrary PHP code on the server.
**Recommendations**
Update Cart All In One For WooCommerce to version 1.1.22 or later.