{"id":94393,"date":"2026-08-29T13:51:32","date_gmt":"2026-08-29T17:51:32","guid":{"rendered":"https:\/\/litextension.com\/blog\/?p=94393"},"modified":"2026-09-04T14:06:29","modified_gmt":"2026-09-04T18:06:29","slug":"security-advisory","status":"publish","type":"post","link":"https:\/\/litextension.com\/blog\/security-advisory\/","title":{"rendered":"Security Advisory: Connector vulnerabilities in the LitExtension WooCommerce Migration plugin"},"content":{"rendered":"

Affected versions:<\/strong> 1.2.5 and earlier \u00b7
\nFixed in:<\/strong> 1.2.6 and 1.2.7 \u00b7
\nCVE:<\/strong> CVE-2026-15046 \u00b7
\nSeverity:<\/strong> Medium (CVSS 4.2)<\/p>\n

Summary<\/h2>\n

A security researcher reported a vulnerability in the way our WordPress migration plugin installed and authenticated its migration connector. We released fixes in versions 1.2.6 and 1.2.7, and both are available now through the WordPress plugin directory.<\/p>\n

If you are running version 1.2.5 or earlier, update immediately<\/strong>. If you have finished your migration, we recommend deleting the plugin entirely.<\/p>\n

What the issue was<\/h2>\n

The plugin’s connector is a small bridge file created during a migration so that data can be transferred into your store. Two problems existed in how it worked:<\/p>\n

Missing CSRF protection.<\/strong> The administrative action that installed or updated the connector’s authentication token read that token from a URL parameter and did not verify a WordPress nonce. An attacker could craft a link that, if opened by a logged-in administrator, would overwrite the connector token with a value the attacker chose. The attacker did not need credentials for your site \u2014 only for an administrator to click the link while logged in.<\/p>\n

An over-permissive connector.<\/strong> The connector authorised requests using that token alone, and had broader capabilities than a migration tool requires. Combined with the first issue, a researcher demonstrated that a controlled token could be used to write and execute code on the site.<\/p>\n

We want to state this plainly: this was not a low-impact issue for sites that met the conditions below. We have treated it accordingly.<\/p>\n

Who was affected<\/h2>\n

The connector bridge file only exists after a migration has been set up<\/strong>. It is not present on a fresh install. If you installed the plugin but never started a migration, this issue could not be triggered on your site.<\/p>\n

Sites running 1.2.5 or earlier with a connector installed<\/strong> were the ones at risk.<\/p>\n

What we fixed<\/h2>\n

In 1.2.6:<\/strong><\/p>\n