CVEvulnerability

CVE-2026-15046

4.2 MEDIUM Published 2026-08-21 Modified 2026-10-16 Official page ↗
Status
Deferred
Published
2026-08-21
Last modified
2026-10-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.2 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-352

Description

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References