What the vulnerability does
01Description
The Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.11. This is due to missing or incorrect nonce validation on the save_setting() function. This makes it possible for unauthenticated attackers to update arbitrary options and achieve privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Shopwarden versions up to 1.0.11 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user. The vulnerability requires user interaction—the victim must visit a malicious page while authenticated to Shopwarden. An attacker can read sensitive data, modify site settings, or disrupt service availability.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on a Shopwarden account by tricking a logged-in user into visiting a malicious page.
Potential impact on your site
04Site Impact
An attacker can modify WooCommerce monitoring settings, access test results, or disrupt automated testing without your knowledge or consent.
Conditions required to exploit
05Prerequisites
Victim must be logged into Shopwarden and click a malicious link or visit an attacker-controlled page.
Key dates
06Disclosure timeline
February 18, 2025
CVE published
April 8, 2026
Record updated
