CVE-2026-15046 — LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, all…
Published: 2026-08-21 · CVSS: 4.2 · CVSS 3.1
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7