MEDIUM 4.2 NVD

CVE-2026-15046

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authenti

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).

References

https://wpscan.com/vulnerability/3d377332-e19e-42fa-9522-3fca239edede/

Published: 2026-08-21 · Source: NVD · Feed updated: 2026-08-21

This medium severity vulnerability with a CVSS score of 4.2 was published on 2026-08-21 via NVD.

vulnfeed aggregates 11625 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.