What is the CVSS score of CVE-2026-8904?

CVE-2026-8904 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

FastPicker CVE-2026-8904

EUVD-2026-35315 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-09 Wordfence

GHSA-53rv-8hrr-x4qf

CSRF WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:14 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 4.3

DescriptionCVE.org

The FastPicker, an order picker and order management system (oms) for WooCommerce on steroids plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect nonce validation on the settingsPage function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including toggling the webhook integration and changing the FastPicker and KDZ API URLs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in FastPicker (versions up to and including 1.0.2), a WooCommerce order management plugin for WordPress, allows unauthenticated remote attackers to modify the plugin's administrative settings by tricking a logged-in site administrator into clicking a crafted link. Specifically, the settingsPage function in Admin.php lacks proper nonce validation, enabling forged POST requests that can toggle the plugin's webhook integration and redirect FastPicker and KDZ API endpoint URLs to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in the WordPress plugin 'FastPicker, an Order Picker and Order Management System (OMS) for WooCommerce on Steroids' by vendor Yuluma (CPE: cpe:2.3:a:yuluma:fastpicker,_an_order_picker_and_order_management_system_(oms)_for_woocommerce_on_steroids:*:*:*:*:*:*:*:*). WordPress uses cryptographic nonces to bind admin form submissions to an authenticated session, preventing CSRF attacks. The settingsPage function (located at src/WooOrderpicker/Admin.php#L29 and rendered via src/Views/Settings.php#L32) processes settings updates without verifying a WordPress nonce, which is classified as CWE-352 (Cross-Site Request Forgery). This means any authenticated administrator who visits a malicious page or clicks a crafted URL will unknowingly submit a valid settings-modification request. The practical consequence is that attacker-controlled API URLs could redirect order management data to a hostile endpoint, creating a secondary integrity and potential data-exfiltration risk beyond the direct CSRF impact.

RemediationAI

No specific patched version number is confirmed in the provided data; administrators should check the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d1e3a7d8-d303-4638-8dc9-c62302cfa5fb?source=cve and the WordPress plugin repository for an updated release that adds proper nonce validation to the settingsPage function. As a compensating control while awaiting a patch, administrators can deactivate the FastPicker plugin entirely if warehouse order-picking functionality is not critical - this eliminates the attack surface with no meaningful side effect beyond loss of plugin features. Alternatively, implementing a Web Application Firewall rule that blocks POST requests to the plugin's settings endpoint from origins other than the site's own domain can reduce CSRF exposure, though this does not fix the root cause. Restricting the WordPress admin dashboard to known IP ranges via server-level access controls (e.g., nginx allow/deny directives or .htaccess) would also prevent the social-engineering precondition from being satisfied remotely.