# WooCommerce <= 11.0.1 - Cross-Site Request Forgery to Plugin Installation

- **ID:** WPSEC-2026-3143
- **Plugin:** WooCommerce (`woocommerce`), https://wordpress.org/plugins/woocommerce/
- **Affected versions:** from 2.6.0 before 11.1.0
- **Fixed in:** 11.1.0 (Update to 11.1.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woocommerce
- **Fix released:** 2026-09-03
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3143/

## Description

The WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'wc-install-plugin-redirect' parameter in versions 2.6.0 up to, and including, 11.0.1, due to missing nonce validation in the admin_redirects() function. The function checked only the user's install_plugins capability and an allowlisted plugin slug before generating a valid plugin installation nonce and redirecting to the WordPress plugin installer. This makes it possible for unauthenticated attackers to cause the WooCommerce Stripe Gateway plugin to be installed (but not activated) via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-3143/
- https://plugins.svn.wordpress.org/woocommerce/tags/11.1.0/
- https://wordpress.org/plugins/woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3143/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.