CVE-2026-15046

Name of the Vulnerable Software and Affected Versions LitExtension WordPress plugin versions prior to 1.2.6

Description The plugin fails to verify a nonce (a unique token used to prevent replay attacks) before performing an administrative action that overwrites the store-migration connector's authentication token. This allows an attacker to perform a Cross-Site Request Forgery (CSRF) attack by tricking a logged-in administrator into clicking a specially crafted link, which can lead to the takeover of the connector token.

Recommendations Update the plugin to version 1.2.6 or later.