PT-2026-20296 · WordPress+1 · Cart All In One For Woocommerce+1

Phap Nguyen Anh · Publicado 2026-02-18 · Atualizado 2026-02-23 · CVE-2026-2019

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cart All In One For WooCommerce versions prior to 1.1.22

Description The Cart All In One For WooCommerce plugin for WordPress is susceptible to code execution. This occurs because of inadequate input validation on the 'Assign page' field, which is directly passed to the eval() function. This allows authenticated attackers with Administrator-level access or higher to execute arbitrary PHP code on the server.

Recommendations Update Cart All In One For WooCommerce to version 1.1.22 or later.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2026-2019

Produtos afetados

Cart All In One For Woocommerce

Woocommerce

Referências · 10

• https://plugins.trac.wordpress.org/browser/woo-cart-all-in-one/tags/1.1.21/includes/frontend/sidebar-cart-icon.php#L245 · Nota
• https://twitter.com/CVEnew/status/2024026136091439348 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3455202 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/25bdb89f-3478-4a1a-8bf0-46e88207eb21?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/woo-cart-all-in-one/trunk/includes/frontend/sidebar-cart-icon.php#L245 · Nota
• https://t.me/CVEtracker/44942 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2024036177347514558 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2019 · Nota de Segurança
• https://t.me/cveNotify/152294 · Publicação no Telegram
• https://twitter.com/cracbot/status/2025888428911714573 · Publicação no Twitter