CVE-2026-39671: WooCommerce Extra Fees Plugin CSRF Flaw

CVE-2026-39671 Overview

CVE-2026-39671 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Dotstore Extra Fees Plugin for WooCommerce (woo-conditional-product-fees-for-checkout). The flaw affects all plugin versions up to and including 4.3.3. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized state-changing actions on the WooCommerce site. Successful exploitation requires user interaction but no privileges on the target site. The vulnerability impacts integrity and availability of the affected WordPress store.

Critical Impact

An attacker can trick an authenticated administrator into executing unintended actions on the WooCommerce store, potentially modifying fee configurations or disrupting checkout functionality.

Affected Products

• Dotstore Extra Fees Plugin for WooCommerce (woo-conditional-product-fees-for-checkout)
• All versions from initial release through 4.3.3
• WordPress installations using the affected plugin with WooCommerce

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-39671 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-39671

Vulnerability Analysis

The vulnerability stems from missing or improperly validated anti-CSRF tokens in the plugin's administrative request handlers. The plugin processes state-changing requests without verifying that the request originated from a legitimate user session. An attacker hosts a malicious page containing a forged form or JavaScript payload targeting the plugin's endpoints. When an authenticated WooCommerce administrator visits the attacker-controlled page, the browser sends the forged request with valid session cookies attached. The plugin processes the request as if it came from the legitimate administrator.

The attack requires user interaction, reflected in the UI:R portion of the CVSS vector. No authentication or privileges are required on the attacker's side. Impact falls on integrity (low) and availability (high), since forged requests can alter plugin configuration and disrupt checkout flows that depend on conditional fee logic.

Root Cause

The root cause is the absence of WordPress nonce verification on sensitive plugin actions. WordPress provides wp_nonce_field() and check_admin_referer() functions to defend against CSRF. The affected plugin endpoints fail to validate these tokens before executing administrative changes, allowing cross-origin requests carrying authenticated session cookies to succeed.

Attack Vector

Exploitation proceeds over the network. An attacker delivers a crafted link or embedded resource through phishing, a compromised website, or a malicious advertisement. When an administrator with an active WordPress session loads the resource, the browser automatically submits the forged request to the target WooCommerce site. The plugin executes the requested action without origin validation. See the Patchstack WooCommerce Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-39671

Indicators of Compromise

• Unexpected modifications to extra fee rules, conditions, or pricing configurations in the WooCommerce admin panel
• HTTP POST requests to plugin admin endpoints with Referer headers pointing to external domains
• Administrator session activity originating from pages outside the WordPress admin area
• Checkout disruptions or anomalous fee calculations reported by customers

Detection Strategies

• Monitor WordPress administrative actions through audit logging plugins to identify unauthorized configuration changes
• Inspect web server access logs for POST requests to woo-conditional-product-fees-for-checkout endpoints with mismatched Referer or Origin headers
• Compare current plugin configuration against known-good baselines to detect tampering

Monitoring Recommendations

• Enable WordPress activity logging to capture all administrator-initiated changes to plugin settings
• Forward web server access logs to a centralized logging platform for correlation and alerting
• Alert on administrator account activity occurring outside business hours or from unusual geographic locations

How to Mitigate CVE-2026-39671

Immediate Actions Required

• Update the Dotstore Extra Fees Plugin for WooCommerce to a version higher than 4.3.3 once a patch is released by the vendor
• Restrict administrator access to trusted networks and require multi-factor authentication on all WordPress admin accounts
• Educate administrators to log out of WordPress sessions before browsing untrusted websites

Patch Information

The Patchstack advisory lists affected versions as n/a through <= 4.3.3. Administrators should consult the Patchstack WooCommerce Vulnerability entry and the vendor's plugin page for current patch availability and apply updates as soon as a fixed release is published.

Workarounds

• Disable the Extra Fees Plugin for WooCommerce until a patched version is installed if the plugin is not business-critical
• Deploy a web application firewall (WAF) with rules that enforce Origin and Referer header validation on WordPress admin requests
• Use browser isolation or separate browser profiles for WordPress administrative work to limit cross-site request exposure

# Configuration example: temporarily deactivate the plugin via WP-CLI
wp plugin deactivate woo-conditional-product-fees-for-checkout

# Verify deactivation status
wp plugin status woo-conditional-product-fees-for-checkout