The LitExtension WordPress plugin versions through 1.2.5 contain a CSRF vulnerability (CWE-352) where the plugin fails to verify a nonce before executing an administrative action that overwrites the store-migration connector's authentication token. An attacker can exploit this by tricking an authenticated administrator into clicking a malicious link, resulting in the attacker gaining control over the connector token.

Successful exploitation allows an attacker to take over the store-migration connector's authentication token, potentially enabling unauthorized actions related to store migration. The CVSS score is 4.2 (medium severity), reflecting limited impact on confidentiality and integrity, and no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged in and consider implementing additional CSRF protections or restricting administrative access.