CVE-2026-15046: LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Sites running the LitExtension WordPress plugin version 1.2.5 or earlier are exposed if an administrator can be induced to click an attacker-crafted link while logged in.
What does an attacker need to exploit it?
The attacker does not need prior privileges, but exploitation requires user interaction from a logged-in administrator. The attacker relies on a CSRF request to invoke the administrative action that overwrites the migration connector authentication token.
What is the impact if exploitation succeeds?
The attacker can replace and take over the store-migration connector's authentication token. The stated impact includes limited confidentiality and integrity effects, with no availability impact.