What is the CVSS score of CVE-2026-39671?

CVE-2026-39671 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-39671?

The Dotstore Extra Fees Plugin for WooCommerce (versions ≤4.3.3) contains a cross-site request forgery vulnerability that allows attackers to manipulate plugin settings and checkout configurations by…

How to fix or mitigate CVE-2026-39671?

Within 24 hours: Identify all WordPress installations using Dotstore Extra Fees Plugin and document current versions via plugin inventory or WordPress admin audit. Within 7 days: Disable the plugin or restrict administrator access to trusted networks only; educate WordPress administrators on phishing and malicious link risks via security awareness communication. Within 30 days: Monitor vendor advisories for patch release (current status: no patch available); evaluate alternative fee management plugins with CSRF protections; implement WordPress nonce verification requirements if custom development is feasible, or prepare migration plan upon patch availability.

WordPress CVE-2026-39671

EUVD-2026-20349 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-08 Patchstack

GHSA-fmp6-mwg6-hg78

WordPress CSRF

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:07 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:26 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

7.1 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20349

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery.This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.

AnalysisAI

Cross-Site Request Forgery in Dotstore Extra Fees Plugin for WooCommerce versions through 4.3.3 allows remote attackers to execute unauthorized administrative actions on behalf of authenticated WordPress administrators by tricking them into visiting malicious websites or clicking crafted links. The vulnerability enables attackers to modify plugin settings, create unauthorized fees, or alter checkout configurations without the administrator's knowledge. While no active exploitation is confirmed (CISA KEV absent) and EPSS probability is minimal (0.01%, 1st percentile), the CVSS score of 7.1 reflects potential for broad impact across WordPress e-commerce sites using this plugin.

Technical ContextAI

This CSRF vulnerability (CWE-352) exists in the Extra Fees Plugin for WooCommerce (woo-conditional-product-fees-for-checkout), a WordPress plugin by Dotstore that adds conditional fee functionality to WooCommerce checkout processes. CSRF vulnerabilities occur when web applications fail to implement anti-CSRF tokens or nonce validation on state-changing requests, allowing attackers to forge authenticated requests from victims' browsers. The affected CPE (cpe:2.3:a:dotstore:extra_fees_plugin_for_woocommerce) covers all versions through 4.3.3, indicating missing or insufficient nonce protection on administrative forms or AJAX endpoints that control fee configuration. This class of vulnerability is particularly common in WordPress plugins where developers may overlook WordPress's built-in nonce functions (wp_nonce_field, wp_verify_nonce) when implementing custom administrative interfaces.

RemediationAI

WordPress administrators should immediately upgrade the Extra Fees Plugin for WooCommerce to version 4.3.4 or later where CSRF protections have been implemented, applying available patches from the WordPress plugin repository or the vendor's official distribution channel. Until patching is complete, implement temporary mitigations including restricting administrative access to trusted networks only via IP allowlisting, educating admin users about CSRF risks and avoiding clicking untrusted links while logged into WordPress, and enabling WordPress security plugins that provide additional CSRF validation layers. Review WordPress audit logs for suspicious administrative actions during the vulnerable period, particularly unexpected changes to fee configurations or checkout settings. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woo-conditional-product-fees-for-checkout/vulnerability/wordpress-extra-fees-plugin-for-woocommerce-plugin-4-3-3-cross-site-request-forgery-csrf-vulnerability and monitor vendor communications from Dotstore for additional security guidance and confirmation of complete remediation in patched versions.