CVE-2026-15046: CWE-352 Cross-Site Request Forgery (CSRF) in LitExtension

The LitExtension WordPress plugin through version 1.2.5 fails to verify a nonce before executing an administrative action that overwrites the authentication token for the store-migration connector. This lack of CSRF protection enables attackers to coerce authenticated administrators into performing unintended actions by clicking malicious links, thereby allowing the attacker to take control of the connector token.

An attacker can exploit this vulnerability to overwrite the store-migration connector's authentication token by tricking an authenticated administrator into clicking a crafted link. This could lead to unauthorized control over the connector token, potentially impacting the integrity of store migration processes. The CVSS 3.1 base score is 4.2 (medium severity), reflecting low confidentiality and integrity impact with no availability impact.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress with administrative privileges and consider restricting access to the plugin's administrative functions.