WooCommerce <= 11.0.1 - Cross-Site Request Forgery to Plugin Installation
- ID
- WPSEC-2026-3143
- Plugin
- WooCommerce (woocommerce)
- Affected
- from 2.6.0 before 11.1.0
- Remediation
- Update to 11.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-14
- Attack surface
- WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'wc-install-plugin-redirect' parameter in versions 2.6.0 up to, and including, 11.0.1, due to missing nonce validation in the admin_redirects() function. The function checked only the user's install_plugins capability and an allowlisted plugin slug before generating a valid plugin installation nonce and redirecting to the WordPress plugin installer. This makes it possible for unauthenticated attackers to cause the WooCommerce Stripe Gateway plugin to be installed (but not activated) via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-3143/
- https://plugins.svn.wordpress.org/woocommerce/tags/11.1.0/
- https://wordpress.org/plugins/woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS