CoCart - Headless REST API for WooCommerce
Healthy: vulnerability published 2 Oct 2026, fixed in 4.9.7.
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 80 |
| Support | 70 |
| Reputation | 70 |
Active signals
Facts we detected, with links to the source.
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| sebd86 | 26 Feb 2018 to 30 Sep 2026, 244 commits |
|---|---|
| cocartforwc | 11 Jan 2025 to 19 Jun 2026, 39 commits |
2 committers recorded. No ownership changes recorded since 3 Nov 2026.
Maintenance
- Last release
- 35 days ago
- Releases, 24 months
- 60
- Tested up to
- 7.1 current
- Requires PHP
- 7.4 supported 8.2+
| Q1 2024 | 32 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 1 |
| Q4 2024 | 17 |
| Q1 2025 | 1 |
| Q2 2025 | 10 |
| Q3 2025 | 6 |
| Q4 2025 | 1 |
| Q1 2026 | 2 |
| Q2 2026 | 15 |
| Q3 2026 | 8 |
| Q4 2026 | 0 |
Last release 30 Sep 2026. Tested with WordPress 7.1 (current).
Support
Support history appears after our first snapshots of the forum counts.
Security record
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 2 Oct 2026 | CoCart 4.9.0 - 4.9.6 - Cross-Site Request Forgery to Privilege Escalation | 8.8 | 4.9.0 to 4.9.6 | 4.9.7 | 0 |
| 23 Jul 2026 | CoCart – Headless REST API for WooCommerce <= 4.8.4 - Missing Authorization | 5.3 | <= 4.8.4 | 4.9.0 | n/a |
| 20 Jul 2026 | CoCart <= 4.8.0 - Unauthenticated Price Manipulation | 5.3 | <= 4.8.0 | 4.9.0 | n/a |
| 7 Nov 2023 | CoCart – Headless ecommerce <= 3.11.2 - Missing Authorization | 5.3 | <= 3.11.2 | 3.12.0 | n/a |
Source: Wordfence Intelligence.
Reputation
Lifetime rating 4.9 from 21 ratings. Quarterly trends appear as new reviews arrive.
| 5 star | 20 |
|---|---|
| 4 star | 0 |
| 3 star | 0 |
| 2 star | 1 |
| 1 star | 0 |
Momentum
900+ active installs. History builds with each weekly snapshot.
Momentum history builds with each snapshot.
Healthier alternatives
Same category, higher Canary Score. Never sponsored.
No healthier plugin in the same category yet.
Facts
| Version | 4.9.7 |
|---|---|
| Author | CoCart Headless |
| Added | 26 Feb 2018 |
| Last updated | 30 Sep 2026 |
| Active installs | 900+ |
| Requires WordPress | 6.7 |
| Tested up to | 7.1.4 |
| Requires PHP | 7.4 |
| Category | E-commerce & Shopping |
| Tags | cart, headless, rest-api, decoupled, woocommerce |
Other plugins by this author: CoCart CORS Support, CoCart JWT Authentication, CoCart - Cart API Enhanced, CoCart - Rate Limiting
Questions
Is CoCart - Headless REST API for WooCommerce still maintained?
CoCart - Headless REST API for WooCommerce was last updated on 30 Sep 2026. Its Canary status is Healthy.
Is CoCart - Headless REST API for WooCommerce safe?
CoCart - Headless REST API for WooCommerce has no open unpatched vulnerabilities on record. 3 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.
Who owns CoCart - Headless REST API for WooCommerce?
The wordpress.org author is CoCart Headless. Recent committers: sebd86, cocartforwc, plugin-master. We have recorded no ownership change.
What can I use instead of CoCart - Headless REST API for WooCommerce?
We have no healthier plugin in the same category on record yet.