This hardcoded fallback is reachable when the plugin is activated via WP-CLI, network-wide, or programmatically without a subsequent wp-admin visit, as the legitimate token generation is deferred to the admin_init hook. An unauthenticated attacker can supply the string __token__ to the REST endpoint to bypass authentication. Once inside, the attacker can leverage privileged handlers to execute arbitrary SQL queries against the database (enabling admin account creation) and trigger arbitrary file deletion via unlink(), potentially resulting in a full site takeover.

Attack Chain

1. Attacker performs reconnaissance to identify WordPress sites with the Next-Cart plugin activated via CLI or programmatic methods.
2. Attacker interacts with the REST API endpoint at /wp-json/next_cart/v1/migration.
3. Attacker submits the literal string __token__ in the request parameters to the endpoint.
4. The plugin fails to validate authentication due to the insecure permission_callback and the hardcoded fallback token.
5. Attacker sends malicious SQL payloads to the migration handler, which passes them to $wpdb->query().
6. Attacker inserts a new administrator user into the wp_users and wp_usermeta tables.
7. Attacker sends file system commands to the handler, which passes paths to unlink() for arbitrary file deletion.
8. Attacker completes site takeover by leveraging elevated privileges and persistence through newly created accounts.

Impact

Successful exploitation of CVE-2026-76009 allows unauthenticated remote attackers to gain full administrative control over the affected WordPress site. Impacts include unauthorized access to sensitive customer data, site defacement, the injection of malicious code into the database, and the potential for complete site compromise. Given the prevalence of WordPress installations and the nature of migration tools, a significant number of instances configured via non-interactive means are at risk.

Recommendation

1. Upgrade the Next-Cart Store to WooCommerce Migration plugin to a version beyond 3.9.8 immediately.
2. Audit the wp_users and wp_usermeta tables for unauthorized administrative accounts created post-deployment.
3. Inspect web server access logs for requests directed at /wp-json/next_cart/v1/migration containing the __token__ string.
4. Perform a security review of site plugins to ensure no other REST routes lack proper permission_callback validation.