توضیحات
Ship your headless WooCommerce storefront faster. CoCart is the REST API built for Next.js, React, Vue, and any modern frontend — developer-first.
تغییرات این نسخه
CoCart is open source and community-driven. Every release is tested, maintained, and published here on WordPress.org. Need more power? CoCart Plus unlocks advanced features and priority support.
v4.9.7 – 30th September, 2026
Security Patch
This release hardens how CoCart’s REST authentication check is scoped, ensuring WordPress’s own request verification is not bypassed on other REST endpoints. It is recommended that you update to this release as soon as possible.
REST API: Authentication error check now only applies to requests CoCart authenticated itself, so WordPress’s own nonce verification is no longer bypassed on other endpoints, including the batch endpoint. Reported by Naoki Kawahigashi.
v4.9.6 – 10th September, 2026
Improvement
Developer note: We don’t recommend using plain permalinks as it reduces the performance of lookup but we added support should it be the only option for you. e.g. ?rest_route=/cocart/v2/products
REST API: Recognize requests made via the ?rest_route= query parameter (plain permalinks).
WordPress Dashboard: Prevent enabling integrations without a loader module.
Compatibility
Tested with WooCommerce v11.1
v4.9.5 – 1st September, 2026
Security Patch
This release hardens how the cart session handler validates the cart key, however it is supplied — whether as a request parameter or via the header — ensuring a cart can only be loaded by the account it actually belongs to. It is recommended that you update to this release as soon as possible.
v4.9.7 – 30th September, 2026
Security Patch
This release hardens how CoCart’s REST authentication check is scoped, ensuring WordPress’s own request verification is not bypassed on other REST endpoints. It is recommended that you update to this release as soon as possible.
REST API: Authentication error check now only applies to requests CoCart authenticated itself, so WordPress’s own nonce verification is no longer bypassed on other endpoints, including the batch endpoint. Reported by Naoki Kawahigashi.
v4.9.6 – 10th September, 2026
Improvement
Developer note: We don’t recommend using plain permalinks as it reduces the performance of lookup but we added support should it be the only option for you. e.g. ?rest_route=/cocart/v2/products
REST API: Recognize requests made via the ?rest_route= query parameter (plain permalinks).
WordPress Dashboard: Prevent enabling integrations without a loader module.
Compatibility
Tested with WooCommerce v11.1
v4.9.5 – 1st September, 2026
Security Patch
This release hardens how the cart session handler validates the cart key, however it is supplied — whether as a request parameter or via the header — ensuring a cart can only be loaded by the account it actually belongs to. It is recommended that you update to this release as soon as possible.