CVE-2026-8904 describes a CSRF vulnerability in the FastPicker plugin for WooCommerce by yuluma. The issue is due to missing or incorrect nonce validation on the settingsPage function, which handles plugin settings. An attacker can exploit this by tricking an authenticated site administrator into performing an action via a forged request, enabling modification of critical plugin settings such as webhook integration and API URLs. This affects all versions up to and including 1.0.2.

An attacker can cause an authenticated administrator to unknowingly change plugin settings, potentially disrupting order management workflows or redirecting API communications. The vulnerability does not allow direct data disclosure or denial of service but can lead to integrity issues by altering configuration parameters.

No official patch or remediation is currently available. Users should monitor the vendor advisory for updates. As a temporary measure, administrators should be cautious about clicking untrusted links while logged into the WordPress admin interface. Implementing additional CSRF protections or nonce validation in the plugin code can mitigate the risk if feasible.