medium4.2
CVE-2026-15046
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authent…
Impact
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
Affected products
| Product | Affected versions |
|---|---|
| LitExtension WordPress Plugin | through 1.2.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.