CVE-2026-24365: WooCommerce Stock Manager CSRF Vulnerability

CVE-2026-24365 Overview

CVE-2026-24365 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the storeapps Stock Manager for WooCommerce plugin (woocommerce-stock-manager) for WordPress. The flaw affects all plugin versions up to and including 3.6.0. An attacker can craft a malicious web page that triggers state-changing requests on the WordPress site when a privileged user visits it. Successful exploitation requires user interaction and can result in limited integrity and availability impact on the targeted store.

Critical Impact

Attackers can leverage an authenticated administrator's browser session to perform unauthorized stock-management actions in WooCommerce, altering inventory data without consent.

Affected Products

• storeapps Stock Manager for WooCommerce plugin versions prior to 3.6.0
• WordPress sites running the woocommerce-stock-manager plugin
• WooCommerce stores relying on the plugin for inventory operations

Discovery Timeline

• 2026-01-22 - CVE-2026-24365 published to NVD
• 2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-24365

Vulnerability Analysis

The vulnerability stems from missing or insufficient CSRF protections on state-changing endpoints exposed by the Stock Manager for WooCommerce plugin. WordPress plugins typically protect privileged actions with nonce tokens validated through check_admin_referer() or wp_verify_nonce(). When these checks are absent, an attacker can forge requests that the browser of an authenticated user executes automatically.

The attack requires a logged-in administrator or shop manager to visit an attacker-controlled page. The malicious page submits a forged request to the vulnerable plugin endpoint, leveraging the victim's session cookies. The action runs with the victim's privileges, modifying stock data or related plugin settings.

Impact is limited to integrity and availability of inventory information rather than full site compromise. However, manipulating stock levels can disrupt commerce operations, trigger inaccurate fulfillment, and create downstream business logic issues.

Root Cause

The root cause is missing CSRF token validation on plugin request handlers prior to version 3.6.0. The plugin accepts state-changing POST or GET requests without verifying that the request originated from a legitimate plugin interface. This omission maps directly to CWE-352: Cross-Site Request Forgery.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a page containing a hidden form or JavaScript that auto-submits to the vulnerable WordPress admin endpoint. When a privileged user with an active session visits the page, the browser attaches authentication cookies, and the request executes server-side. No credentials are exposed to the attacker, but the action completes as if the user initiated it. See the Patchstack advisory for technical details.

Detection Methods for CVE-2026-24365

Indicators of Compromise

• Unexpected modifications to product stock quantities, SKUs, or inventory metadata without corresponding admin user activity
• WordPress access logs showing POST requests to Stock Manager plugin endpoints with external Referer headers
• Administrator sessions executing plugin actions immediately after browsing third-party websites

Detection Strategies

• Audit WooCommerce stock change logs and compare against authenticated admin actions in the WordPress audit trail
• Monitor HTTP request patterns for plugin endpoints lacking valid _wpnonce parameters
• Inspect web server logs for cross-origin Referer values targeting wp-admin endpoints associated with the plugin

Monitoring Recommendations

• Enable detailed WordPress activity logging using a security plugin to capture user-driven stock changes
• Forward web server and WordPress audit logs to a centralized log analytics platform for correlation
• Alert on bulk inventory modifications occurring outside business hours or from unusual admin sessions

How to Mitigate CVE-2026-24365

Immediate Actions Required

• Update the Stock Manager for WooCommerce plugin to a version later than 3.6.0 that includes the CSRF fix
• Require administrators and shop managers to log out of WordPress when not actively working in the admin panel
• Restrict wp-admin access by IP allowlisting at the web server or WAF layer

Patch Information

Upgrade woocommerce-stock-manager to a release later than 3.6.0 that introduces CSRF nonce validation. Refer to the Patchstack advisory for the fixed version and vendor notes.

Workarounds

• Deploy a Web Application Firewall rule that blocks requests to plugin endpoints lacking a valid _wpnonce parameter or matching Referer
• Enforce SameSite=Strict or SameSite=Lax cookies on WordPress session cookies to limit cross-site request inclusion
• Disable the plugin until patched if inventory automation is not business-critical

# Configuration example: Nginx rule to block requests with cross-origin Referer to wp-admin
location ~* ^/wp-admin/admin(-ajax|-post)\.php$ {
    valid_referers server_names;
    if ($invalid_referer) {
        return 403;
    }
}