CVE-2026-1455: Whatsiplus WooCommerce CSRF Vulnerability

CVE-2026-1455 Overview

The Whatsiplus Scheduled Notification for WooCommerce plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0.1. The vulnerability exists due to missing nonce validation on the wsnfw_save_users_settings AJAX action, allowing unauthenticated attackers to modify plugin configuration settings through forged requests when they can trick an authenticated site administrator into performing an action such as clicking a malicious link.

Critical Impact

Unauthenticated attackers can manipulate plugin settings by exploiting the CSRF vulnerability to forge requests on behalf of authenticated administrators, potentially compromising WooCommerce notification functionality and site integrity.

Affected Products

• Whatsiplus Scheduled Notification for WooCommerce WordPress Plugin versions up to and including 1.0.1
• WordPress sites using the affected plugin versions
• WooCommerce installations with the Whatsiplus notification plugin enabled

Discovery Timeline

• 2026-02-19 - CVE-2026-1455 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-1455

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The core issue stems from the plugin's failure to implement proper nonce verification in its AJAX handler for saving user settings. WordPress provides built-in security mechanisms for AJAX operations, including nonce tokens that verify the legitimacy of requests. When these protections are absent, attackers can craft malicious pages that submit requests to the vulnerable endpoint using the session of any authenticated administrator who visits the attacker-controlled page.

The vulnerable code is located in the wsnfw-ajax-request.php file, specifically in the AJAX action handler for wsnfw_save_users_settings. Without nonce validation, the plugin cannot distinguish between legitimate requests initiated by the administrator and forged requests from external sources.

Root Cause

The root cause is the absence of nonce validation in the wsnfw_save_users_settings AJAX action handler. WordPress security best practices require developers to use wp_verify_nonce() or check_ajax_referer() functions to validate that requests originate from legitimate sources within the WordPress admin interface. The vulnerable plugin code processes configuration changes without performing these critical security checks.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must craft a malicious web page containing a forged request targeting the vulnerable AJAX endpoint. When a WordPress site administrator with active session credentials visits the malicious page, the forged request is automatically submitted to their WordPress installation. The browser includes the administrator's session cookies with the request, causing the WordPress server to process the configuration change as if it were a legitimate administrative action.

The attack flow involves social engineering to lure the administrator to a malicious page, followed by automatic submission of the crafted request to the admin-ajax.php endpoint with the wsnfw_save_users_settings action parameter and attacker-controlled configuration values.

Detection Methods for CVE-2026-1455

Indicators of Compromise

• Unexpected changes to Whatsiplus plugin configuration settings without administrator action
• Unusual AJAX requests to admin-ajax.php with the wsnfw_save_users_settings action from external referrers
• WooCommerce notification behavior changes that were not intentionally configured
• Web server logs showing POST requests to admin-ajax.php with suspicious referrer headers

Detection Strategies

• Monitor WordPress admin AJAX requests for the wsnfw_save_users_settings action with external or missing referrer headers
• Implement Web Application Firewall (WAF) rules to detect potential CSRF attack patterns
• Review plugin configuration change logs for unauthorized modifications
• Deploy browser security headers including strict Content-Security-Policy directives

Monitoring Recommendations

• Enable comprehensive logging for WordPress AJAX actions
• Configure alerts for configuration changes to WooCommerce-related plugins
• Implement referrer validation at the WAF level for administrative endpoints
• Regularly audit plugin settings to detect unauthorized modifications

How to Mitigate CVE-2026-1455

Immediate Actions Required

• Update the Whatsiplus Scheduled Notification for WooCommerce plugin to a patched version when available
• Temporarily disable the plugin if updates are not yet available and the functionality is not critical
• Implement WAF rules to filter suspicious requests targeting the vulnerable AJAX action
• Educate site administrators about the risks of clicking untrusted links while logged into WordPress

Patch Information

Plugin users should check the WordPress Plugin Repository for updated versions that include nonce validation. Additional vulnerability details are available in the Wordfence Vulnerability Report. The vendor should implement proper nonce verification using WordPress's built-in check_ajax_referer() or wp_verify_nonce() functions in the AJAX handler.

Workarounds

• Disable the Whatsiplus Scheduled Notification for WooCommerce plugin until a patch is available
• Use a Web Application Firewall to block requests with suspicious referrer patterns targeting the AJAX endpoint
• Restrict administrative access to trusted IP addresses to limit the attack surface
• Implement browser isolation for administrative tasks to prevent CSRF exploitation

# Example .htaccess rule to restrict AJAX access (use with caution)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} admin-ajax\.php
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteRule ^ - [F,L]
</IfModule>