EUVD-2026-63908
GHSA-2f5q-8gh4-r39q
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Network delivery via crafted link (AV:N), social-engineering dependency raises complexity (AC:H), attacker needs no account (PR:N), admin must actively click (UI:R); token overwrite yields limited confidentiality and integrity impact with no availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).
AnalysisAI
CSRF in the LitExtension WordPress migration plugin (≤1.2.5) allows an unauthenticated remote attacker to overwrite the store-migration connector's authentication token by tricking a logged-in administrator into clicking a crafted link. Token replacement gives the attacker control over the connector, potentially enabling unauthorized access to migrated store data or disruption of active migration workflows. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the LitExtension plugin (version ≤1.2.5) to be installed and activated on the target WordPress site with the store-migration connector configured and in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.2 (Medium) accurately reflects the realistic exploit difficulty: attack complexity is High (AC:H) because the attacker must successfully social-engineer a logged-in administrator, and mandatory user interaction (UI:R) constrains automated or mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been independently confirmed from the available data; the WPScan advisory at https://wpscan.com/vulnerability/3d377332-e19e-42fa-9522-3fca239edede/ should be consulted for the latest patch status and any upstream fix releases. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today