Vulnerabilities / Magyar WooCommerce kiegészítések / WPSEC-2026-1630
Magyar WooCommerce kiegészítések <= 2026.2.3 - Cross-Site Request Forgery to Product Price History Deletion
Medium 4.3
CWE-352Fixed in 2026.2.4
- ID
- WPSEC-2026-1630
- Plugin
- HuCommerce | Magyar WooCommerce kiegészítések (surbma-magyar-woocommerce)
- Affected
- all versions before 2026.2.4
- Remediation
- Update to 2026.2.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-25
- Attack surface
- Magyar WooCommerce kiegészítések on WPSec AttackSurface
- Fix released
- Published
Description
The surbma-magyar-woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the price history deletion action of the standalone product price history page in all versions up to, and including, 2026.2.3, due to missing nonce validation on the 'hc-product_price_history' GET request. This makes it possible for unauthenticated attackers to delete the stored price history of any product via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1630/
- https://plugins.svn.wordpress.org/surbma-magyar-woocommerce/tags/2026.2.4/
- https://wordpress.org/plugins/surbma-magyar-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS