WordPress WooCommerce Migration Plugin Authentication Bypass

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option('nextcart_token', '__token__')` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded f

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Next-Cart Store to WooCommerce Migration plugin for WordPress contains a critical authentication bypass vulnerability (CVE-2026-76009, CVSS 8.1) affecting all versions up to 3.9.8. The vulnerability exists in the `NCWM_Kitconnect::run()` function, which registers a REST API endpoint with permission callbacks set to unconditionally return true, combined with a hardcoded fallback token value of `__token__`. This means attackers can bypass authentication mechanisms entirely and access sensitive migration functionality without valid credentials. WordPress sites using this plugin—particularly e-commerce environments migrating from Next-Cart to WooCommerce—face immediate risk of unauthorized access to store data, customer information, and configuration settings.

Casky's 283 matched security skills leverage Claude AI's reasoning capabilities to detect the attack patterns mapped to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify indicators including: REST endpoint requests to `/wp-json/next_cart/v1/migration` with missing or arbitrary authorization headers, successful API responses without valid token validation, and pattern recognition of hardcoded credential usage. The platform's extended reasoning enables detection of the logical flaw—permission callbacks that always return true—and correlates this with CWE-287 (Improper Authentication). Security teams would see findings highlighting unauthenticated REST API access attempts, privilege escalation via permission bypass, and potential credential harvesting vectors, allowing them to prioritize remediation and implement compensating controls immediately.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-76009.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-76009

Casky has 283 skills that investigate the attack patterns behind CVE-2026-76009. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn