CVE-2026-15046 PUBLISHED

LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF

Assigner: WPScan
Reserved: 08.07.2026 Published: 21.08.2026 Updated: 21.08.2026

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS Score: 4.2

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Unknown
Product	LitExtension
Versions	Default: unknown affected from 0 to 1.2.5 (incl.)

Credits

marim00 finder
WPScan coordinator

References

https://wpscan.com/vulnerability/3d377332-e19e-42fa-9522-3fca239edede/

Problem Types

CWE-352 Cross-Site Request Forgery (CSRF) CWE