PT-2026-20296 · WordPress+1 · Cart All In One For Woocommerce+1

Phap Nguyen Anh · Published 2026-02-18 · Updated 2026-02-23 · CVE-2026-2019

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cart All In One For WooCommerce versions prior to 1.1.22

Description The Cart All In One For WooCommerce plugin for WordPress is susceptible to code execution. This occurs because of inadequate input validation on the 'Assign page' field, which is directly passed to the eval() function. This allows authenticated attackers with Administrator-level access or higher to execute arbitrary PHP code on the server.

Recommendations Update Cart All In One For WooCommerce to version 1.1.22 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-2019

Affected Products

Cart All In One For Woocommerce

Woocommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-2019 · Security Note
• https://plugins.trac.wordpress.org/browser/woo-cart-all-in-one/tags/1.1.21/includes/frontend/sidebar-cart-icon.php#L245 · Note
• https://twitter.com/CVEnew/status/2024026136091439348 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3455202 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/25bdb89f-3478-4a1a-8bf0-46e88207eb21?source=cve · Note
• https://plugins.trac.wordpress.org/browser/woo-cart-all-in-one/trunk/includes/frontend/sidebar-cart-icon.php#L245 · Note
• https://t.me/CVEtracker/44942 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2024036177347514558 · Twitter Post
• https://t.me/cveNotify/152294 · Telegram Post
• https://twitter.com/cracbot/status/2025888428911714573 · Twitter Post