VYPR
Medium severity4.3NVD Advisory· Published Jun 9, 2026

CVE-2026-8904

CVE-2026-8904

Description

FastPicker WordPress plugin vulnerable to CSRF, allowing attackers to alter plugin settings and API URLs by tricking administrators.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

FastPicker WordPress plugin vulnerable to CSRF, allowing attackers to alter plugin settings and API URLs by tricking administrators.

Vulnerability

The FastPicker plugin for WooCommerce is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0.2. This vulnerability exists due to insufficient nonce validation within the settingsPage function, which handles plugin settings updates [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by crafting a malicious request and tricking a site administrator into interacting with it, such as clicking a link. This interaction would trigger the settingsPage function without proper validation, allowing the attacker to modify plugin settings [1].

Impact

Successful exploitation allows an attacker to modify the plugin's settings. This includes toggling the webhook integration and altering the FastPicker and KDZ API URLs. The scope of the compromise is limited to the plugin's configuration settings.

Mitigation

Versions of the FastPicker plugin up to and including 1.0.2 are affected. A fixed version has not yet been disclosed in the available references. Users are advised to monitor for updates from the plugin vendor.

AI Insight generated on Jun 9, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The plugin fails to validate nonces when processing settings updates, allowing unauthorized modification."

Attack vector

An unauthenticated attacker can craft a malicious request to trick a site administrator into clicking a link or submitting a form. This forged request exploits the missing nonce validation in the settingsPage function to modify plugin settings. Specifically, attackers can toggle webhook integrations and alter FastPicker and KDZ API URLs [ref_id=1].

Affected code

The vulnerability lies within the settings update logic in the Admin.php file, specifically in the part of the settingsPage function that handles POST requests to update options like webhook integration, FastPicker API URL, and KDZ API URL [ref_id=1].

What the fix does

The patch is not provided in the bundle. The advisory indicates that the vulnerability is due to missing or incorrect nonce validation on the settingsPage function. Remediation would involve implementing proper nonce checks before processing any POST requests that modify plugin settings.

Preconditions

  • authThe attacker does not need to be authenticated.
  • inputThe attacker needs to trick a site administrator into interacting with a malicious link or form.

Generated on Jun 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.