Medium severity4.3NVD Advisory· Published May 21, 2026· Updated May 21, 2026
CVE-2026-4843
CVE-2026-4843
Description
The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<=2.3.1+ 1 more
- (no CPE)range: <=2.3.1
- (no CPE)range: <=2.3.1
Patches
Vulnerability mechanics
References
2News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (May 18, 2026 to May 24, 2026)Wordfence Blog · May 28, 2026