What the vulnerability does
01Description
The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2.1. This is due to missing nonce validation on the stockist_settings_main() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Stockists Manager for WooCommerce versions up to 1.0.2.1 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the plugin without the admin's knowledge or consent. This can lead to data modification, deletion, or other administrative changes.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on the plugin by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker can modify or delete stockist data, change plugin settings, or perform other admin actions without your permission.
Conditions required to exploit
05Prerequisites
Admin must be logged in and visit an attacker-controlled webpage or click a malicious link.
Key dates
06Disclosure timeline
September 6, 2022
CVE published
April 8, 2026
Record updated
