CVE-2026-1852 is a CSRF vulnerability in the Product Pricing Table by WooBeWoo WordPress plugin affecting all versions up to 1.1.0. The issue arises from missing or incorrect nonce validation on the updateLabel() and remove() functions, enabling attackers to perform unauthorized actions by tricking authenticated site administrators into submitting forged requests. This can lead to injection of arbitrary web scripts or deletion of pricing tables. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting a medium severity impact with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

An attacker can exploit this vulnerability to cause an authenticated administrator to unknowingly execute actions such as injecting malicious scripts into pages or deleting pricing tables. This can result in partial compromise of data integrity and confidentiality within the affected WordPress site. There is no indication of availability impact. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or content that could trigger these vulnerable functions. Monitoring for updates from WooBeWoo regarding patches or mitigations is recommended.