getnewaddress (RPC) on encrypted bitcoin wallet without wallet password? Say for example an encrypted wallet has 5000 addresses already pre-generated in the keypool.

Can getnewaddress be called via RPC command without knowing the actual wallet password?

I envisage a shopping cart script which calls getnewaddress to provide a customer with an address to spend to. The shopping cart would know the RPC password, but not the wallet password. The shopping cart never needs to spend funds.

If the shopping cart was hacked, can bitcoin be stolen?
Check out Hierarchical Deterministic Wallets (BIP32) and eventually this blog-post to get a better understanding of the implications it brings.

There are many wallets today that have BIP32 implemented. Bitcoin Core is NOT one of them and should probably not be used for the wallet feature.

In the scenario you described, your webserver will provide new public addresses, but will also know the private keys to them. Therefore, if your webserver were hacked, the bitcoins could be spend from those addresses.

With BIP32 you can separate the information to create public keys from the information needed to create the corresponding private keys. 
The information to generate the corresponding private keys can be kept in Cold Storage.