CVE-2026-1455: Whatsiplus WooCommerce CSRF Vulnerability

CVE-2026-1455 Overview

The Whatsiplus Scheduled Notification for WooCommerce plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0.1. The vulnerability exists due to missing nonce validation on the wsnfw_save_users_settings AJAX action, allowing unauthenticated attackers to modify plugin configuration settings through forged requests when they can trick an authenticated site administrator into performing an action such as clicking a malicious link.

Critical Impact
Unauthenticated attackers can manipulate plugin settings by exploiting the CSRF vulnerability to forge requests on behalf of authenticated administrators, potentially compromising WooCommerce notification functionality and site integrity.

Affected Products

Whatsiplus Scheduled Notification for WooCommerce WordPress Plugin versions up to and including 1.0.1
WordPress sites using the affected plugin versions
WooCommerce installations with the Whatsiplus notification plugin enabled

Discovery Timeline

2026-02-19 - CVE-2026-1455 published to NVD
2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-1455

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The core issue stems from the plugin's failure to implement proper nonce verification in its AJAX handler for saving user settings. WordPress provides built-in security mechanisms for AJAX operations, including nonce tokens that verify the legitimacy of requests. When these protections are absent, attackers can craft malicious pages that submit requests to the vulnerable endpoint using the session of any authenticated administrator who visits the attacker-controlled page.

The vulnerable code is located in the wsnfw-ajax-request.php file, specifically in the AJAX action handler for wsnfw_save_users_settings. Without nonce validation, the plugin cannot distinguish between legitimate requests initiated by the administrator and forged requests from external sources.

Root Cause

The root cause is the absence of nonce validation in the wsnfw_save_users_settings AJAX action handler. WordPress security best practices require developers to use wp_verify_nonce() or check_ajax_referer() functions to validate that requests originate from legitimate sources within the WordPress admin interface. The vulnerable plugin code processes configuration changes without performing these critical security checks.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must craft a malicious web page containing a forged request targeting the vulnerable AJAX endpoint. When a WordPress site administrator with active session credentials visits the malicious page, the forged request is automatically submitted to their WordPress installation. The browser includes the administrator's session cookies with the request, causing the WordPress server to process the configuration change as if it were a legitimate administrative action.

The attack flow involves social engineering to lure the administrator to a malicious page, followed by automatic submission of the crafted request to the admin-ajax.php endpoint with the wsnfw_save_users_settings action parameter and attacker-controlled configuration values.

Detection Methods for CVE-2026-1455

Indicators of Compromise

Unexpected changes to Whatsiplus plugin configuration settings without administrator action
Unusual AJAX requests to admin-ajax.php with the wsnfw_save_users_settings action from external referrers
WooCommerce notification behavior changes that were not intentionally configured
Web server logs showing POST requests to admin-ajax.php with suspicious referrer headers

Detection Strategies

Monitor WordPress admin AJAX requests for the wsnfw_save_users_settings action with external or missing referrer headers
Implement Web Application Firewall (WAF) rules to detect potential CSRF attack patterns
Review plugin configuration change logs for unauthorized modifications
Deploy browser security headers including strict Content-Security-Policy directives

Monitoring Recommendations

Enable comprehensive logging for WordPress AJAX actions
Configure alerts for configuration changes to WooCommerce-related plugins
Implement referrer validation at the WAF level for administrative endpoints
Regularly audit plugin settings to detect unauthorized modifications

How to Mitigate CVE-2026-1455

Immediate Actions Required

Update the Whatsiplus Scheduled Notification for WooCommerce plugin to a patched version when available
Temporarily disable the plugin if updates are not yet available and the functionality is not critical
Implement WAF rules to filter suspicious requests targeting the vulnerable AJAX action
Educate site administrators about the risks of clicking untrusted links while logged into WordPress

Patch Information

Plugin users should check the WordPress Plugin Repository for updated versions that include nonce validation. Additional vulnerability details are available in the Wordfence Vulnerability Report. The vendor should implement proper nonce verification using WordPress's built-in check_ajax_referer() or wp_verify_nonce() functions in the AJAX handler.

Workarounds

Disable the Whatsiplus Scheduled Notification for WooCommerce plugin until a patch is available
Use a Web Application Firewall to block requests with suspicious referrer patterns targeting the AJAX endpoint
Restrict administrative access to trusted IP addresses to limit the attack surface
Implement browser isolation for administrative tasks to prevent CSRF exploitation

bash

# Example .htaccess rule to restrict AJAX access (use with caution)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} admin-ajax\.php
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteRule ^ - [F,L]
</IfModule>