CSRF Vulnerability in LitExtension Plugin for WordPress
CVE-2026-15046

4.2MEDIUM

Key Information:

Vendor

WordPress
Status
Litextension
Vendor
CVE Published:
21 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15046?

The LitExtension WordPress plugin, up to version 1.2.5, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This issue stems from the plugin's failure to verify nonce tokens before allowing administrative actions. An attacker can exploit this oversight by tricking an authenticated administrator into clicking a specially crafted link, leading to unauthorized changes and potential takeover of the store-migration connector's authentication token. This could enable attackers to perform malicious actions within the store, compromising its security.

Affected Version(s)

LitExtension 0 <= 1.2.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15046 - Proof of Concept

References

https://wpscan.com/vulnerability/3d377332-e19e-42fa-9522-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

marim00
WPScan
.