EUVD-2026-22911
GHSA-4hp8-jw86-79p7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel() and remove() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages or delete pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery (CSRF) in Product Pricing Table by WooBeWoo plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts or delete pricing tables by tricking site administrators into clicking a malicious link, exploiting missing nonce validation in the updateLabel() and remove() functions across all versions up to and including 1.1.0. No public exploit code identified at time of analysis, but the vulnerability requires only user interaction (UI:R) and has a network attack vector, making it moderately exploitable in real-world scenarios.
Technical ContextAI
The Product Pricing Table by WooBeWoo plugin implements administrative AJAX functions (updateLabel and remove) without proper CSRF token (nonce) validation. In WordPress, nonces are cryptographic tokens that prevent unauthorized actions by verifying that requests originate from legitimate administrative sessions. The CWE-352 root cause indicates the plugin fails to implement or properly validate these tokens before processing state-changing operations. The vulnerability affects the WordPress plugin ecosystem, where CSRF flaws against authenticated administrators can lead to unauthorized modifications of site content or database structures. The CPE indicates all versions up to 1.1.0 of the woobeewoo:product_pricing_table_by_woobewoo product are affected.
RemediationAI
Update the Product Pricing Table by WooBeWoo plugin to version 1.1.1 or later, which implements proper nonce validation on the updateLabel() and remove() functions. Site administrators should check the Wordfence vulnerability page (https://www.wordfence.com/threat-intel/vulnerabilities/id/a3b459e0-4bd9-443e-96e4-91663a35c26e) for confirmation of the fix status and deployment instructions. In the interim before applying the patch, limit administrative access to trusted personnel only and monitor audit logs for suspicious admin activity. Additionally, use WordPress security plugins to implement CSRF protection layers and educate administrators about not clicking suspicious links from untrusted sources.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today