LitExtension: Store to WooCommerce Migration <= 1.2.5 – Connector Token Takeover via CSRF | CVE 2026-15046

Description

The plugin does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).

Proof of Concept

The PoC will be displayed on August 28, 2026, to give users the time to update.

Affects Plugins

litextension-data-migration-to-woocommerce

No known fix

References

CVE

CVE-2026-15046

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CWE-352

CVSS

4.2 (medium)

Miscellaneous

Original Researcher

marim00

Submitter

marim00

Verified

Yes

WPVDB ID

3d377332-e19e-42fa-9522-3fca239edede

Timeline

Publicly Published

2026-08-14 (about 7 days ago)

Added

2026-08-07 (about 14 days ago)

Last Updated

2026-08-07 (about 14 days ago)

Other

Published

Title

Published

2025-01-16

Title

Hotspots Analytics <= 4.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2022-04-11

Title

Yoo Slider < 2.1.0 - Arbitrary Template Import via CSRF

Published

2025-06-05

Title

WP Mail Options <= 0.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2024-12-18

Title

Wayne Audio Player <= 1.0 - Cross-Site Request Forgery to Privilege Escalation

Published

2024-08-27

Title

Enhanced Search Box <= 0.6.1 - Settings Update via CSRF