Security Alert Summary
A CSRF vulnerability in the LitExtension WordPress plugin through 1.2.5 allows an attacker to overwrite the store-migration connector’s authentication token by tricking a logged-in administrator into clicking a crafted link. The plugin does not verify a nonce before the administrative action that updates the connector token.
CVE Details
- CVE ID:
CVE-2026-15046 - Affected component: LitExtension WordPress plugin
- Affected versions: Versions up to and including 1.2.5
- Published: August 21, 2026 at 12:16:22 PM UTC
- Last modified: August 21, 2026 at 1:16:52 PM UTC
- CVSS v3.1: Base score 4.2 (MEDIUM) —
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N - Authentication / privileges / user interaction: Privileges required: NONE; User interaction: REQUIRED; Attack complexity: HIGH
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-352 (Cross-Site Request Forgery)
Technical Details
The plugin fails to verify a nonce before performing an administrative action that overwrites the store-migration connector’s authentication token. Because the action lacks proper CSRF protection, an attacker can construct a link that, when clicked by a logged-in administrator, causes the connector token to be replaced with a token controlled by the attacker.
The advisory does not name specific functions or REST API endpoints; the described issue is a missing nonce check that permits CSRF against an administrative token-update action. The direct impact described is takeover of the connector authentication token, consistent with the CVSS confidentiality and integrity impacts.
How This Could Impact Your Website
Consider a small site with a site owner, several internal editors, and an external contractor who manages migrations. If an administrator is tricked into clicking a crafted link, an attacker could overwrite the migration connector token. That overwritten token could allow the attacker to interact with migration-related services or automation that rely on the connector, and could also increase the risk of information exposure tied to those services.
Practical consequences include increased risk of targeted phishing or social engineering against staff, and potential exposure of data accessible via the connector. These impacts align with the CVSS rating of low confidentiality and integrity impact rather than full site compromise. “If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.”
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially administrator and contributor accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior related to connector or migration actions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
