CVE-2026-39671 is a CSRF vulnerability in the Dotstore Extra Fees Plugin for WooCommerce (woo-conditional-product-fees-for-checkout) affecting versions up to 4.3.3. This vulnerability enables an attacker to trick authenticated users into executing unwanted actions within the plugin context. The vulnerability is published and assigned by Patchstack but lacks a CVSS score and vendor remediation details at this time.

Successful exploitation could allow attackers to perform unauthorized state-changing actions on the affected WooCommerce plugin via CSRF, potentially leading to manipulation of extra fee configurations or checkout processes. However, no known exploits have been reported in the wild, and the exact impact depends on the plugin's usage context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections at the application or web server level if possible, or restrict access to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.