Cross-Site Request Forgery Vulnerability in Whatsiplus Scheduled Notification for WooCommerce

CVE-2026-1455

What is CVE-2026-1455?

The Whatsiplus Scheduled Notification for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery due to inadequate nonce validation in the 'wsnfw_save_users_settings' AJAX action. This flaw can be exploited by unauthenticated attackers to alter plugin configuration settings if they can deceive a site administrator into executing a malicious action, such as clicking a link. All versions up to and including 1.0.1 are affected, exposing site integrity to potential unauthorized changes.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References