CVE-2026-76009

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWM Kitconnect::run() function. This is due to the plugin registering the /wp-json/next cart/v1/migration REST route with permission callback set to return true and relying on a hardcoded fallback value of token in get option('nextcart token', ' token ') when the nextcart token option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string token as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to $wpdb->query() and $wpdb->get results() — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to unlink(), enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the nextcart token option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated wp-admin visit, as token generation is deferred to admin init via register settings().