CartFlows: Remote code execution by Contributor-level users

Summary

CartFlows, a WordPress plugin for funnel building and checkout on WooCommerce, contains a remote code execution vulnerability in versions 3.2.0 and earlier. An authenticated user with the Contributor role or higher can run arbitrary commands on the web server. The CNA rates the issue as high severity (CVSS 8.8), but it requires a valid account on the site.

Affected

• CartFlows 3.2.0 and earlier (<= 3.2.0)

Fixed in

• CartFlows 3.2.1 or later

Workaround

Unknown.

Exploitation

• No evidence of active exploitation found; CISA SSVC lists exploitation as none and automatable as no.
• No public proof of concept found, which does not rule one out.
• Patchstack describes the vulnerability as highly dangerous and expects exploitation.

Our recommendation

• Update CartFlows to version 3.2.1 or later on all production and staging sites.
• Review accounts with Contributor, Author, or Editor roles, remove unused accounts, and reset passwords where needed.
• Monitor the Patchstack and Brainstorm Force advisories and the NVD analysis for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for CartFlows <= 3.2.0 patchstack.com
• WordPress.org CartFlows plugin page and changelog wordpress.org
• Sucuri vulnerability patch roundup September 2026 blog.sucuri.net
• Wordfence threat intelligence: CartFlows www.wordfence.com
• CVE-2026-96837 record summary cve.threatint.com
• Strix CVE-2026-96837 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:07.