What is the CVSS score of CVE-2026-4843?

CVE-2026-4843 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

GSheet For Woo Importer CVE-2026-4843

EUVD-2026-31333 MEDIUM

Missing Authorization (CWE-862)

2026-05-21 Wordfence

GHSA-mh3x-vcwp-x5rh

WordPress Google Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 20:34 vuln.today

DescriptionCVE.org

The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.

AnalysisAI

Missing capability check in GSheet For Woo Importer (WordPress plugin, all versions through 2.3.1) allows authenticated attackers with Subscriber-level access to invoke the process_ajax_restore_action() AJAX function and permanently delete the plugin's Google Sheets API token and associated configuration options. This disrupts WooCommerce product import workflows dependent on the Google Sheets integration. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The affected component is the process_ajax_restore_action() function located in src/Actions/AdminSettingsAction.php (line 391 of version 2.3.1, per plugins.trac.wordpress.org). CWE-862 (Missing Authorization) describes the root cause: the AJAX handler registers a callback accessible to low-privilege authenticated users but fails to perform a WordPress capability check (e.g., current_user_can()) before executing a destructive operation - deleting the stored Google Sheets API token and plugin configuration. The affected CPE is cpe:2.3:a:mrdollar4444:gsheet_for_woo_importer:*:*:*:*:*:*:*:* covering the full version range up to and including 2.3.1. This is a class of vulnerability common in WordPress plugins where wp_ajax_ hooks are registered without a nonce-plus-capability guard, giving any authenticated session (even minimal Subscriber role) access to sensitive admin-only actions.

RemediationAI

Check the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b0d60991-0675-4efa-9427-380e6b59fe28) for the confirmed patched release version and upgrade immediately once available via the WordPress plugin repository. No patched version number was included in the provided intelligence data, so the fix version cannot be independently confirmed at this time. As a compensating control while awaiting a patch, administrators should audit all user accounts with Subscriber-level role or above and remove unnecessary accounts, reducing the pool of principals who could trigger this endpoint. Additionally, the plugin can be temporarily deactivated if Google Sheets import functionality is not time-critical - this eliminates the AJAX endpoint entirely. Note that deactivation will halt all automated imports. Restricting wp-admin AJAX access (admin-ajax.php) by IP at the web server or WAF level is another option but carries the trade-off of breaking other legitimate AJAX functionality for remote users.