What is the CVSS score of CVE-2026-6932?

CVE-2026-6932 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WooCommerce Minimum Weight CVE-2026-6932

EUVD-2026-29412 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-12 Wordfence

GHSA-x9wm-2xqw-v725

PHP CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 4.3

DescriptionCVE.org

The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1. This is due to missing nonce verification on the settings update handler in edit-weight.php. This makes it possible for unauthenticated attackers to modify the minimum order weight setting by tricking a site administrator into clicking a link or visiting an attacker-controlled page containing a forged POST request.

AnalysisAI

Cross-Site Request Forgery in WooCommerce Minimum Weight plugin for WordPress up to version 3.0.1 allows unauthenticated attackers to modify minimum order weight settings by tricking site administrators into clicking malicious links or visiting attacker-controlled pages. The vulnerability stems from missing nonce verification in the settings update handler, enabling forged POST requests to alter critical e-commerce configuration without admin consent. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the edit-weight.php file of the WooCommerce Minimum Weight plugin, a WordPress extension that controls minimum order weight thresholds for WooCommerce stores. WordPress nonces are cryptographic tokens that prevent Cross-Site Request Forgery attacks by validating that state-changing requests originate from legitimate admin sessions. The plugin fails to implement nonce verification on its settings update handler, violating WordPress security best practices outlined in the Plugin Development Handbook. This is classified under CWE-352 (Cross-Site Request Forgery), a well-understood vulnerability class in web applications where attackers exploit the browser's automatic credential-sending behavior to perform unauthorized actions on behalf of authenticated users.

RemediationAI

Update the WooCommerce Minimum Weight plugin to the latest patched version released by the vendor following the Wordfence vulnerability disclosure. Site administrators should navigate to WordPress Dashboard → Plugins and update the plugin immediately. If a patched version is not yet available, temporarily disable the plugin via Dashboard → Plugins → Deactivate until the security update is released, then re-enable it once patched. As a compensating control, restrict access to the WordPress admin dashboard using IP whitelisting or Web Application Firewall rules to limit attacker ability to socially engineer administrators into visiting malicious sites while authenticated. Additionally, educate site administrators about phishing and social engineering attacks, and consider implementing WordPress security plugins that monitor for unauthorized admin setting changes. Note that disabling the plugin entirely removes minimum weight enforcement, which may require alternative shipping rule configuration in WooCommerce settings.