CVE-2026-8904 Overview
CVE-2026-8904 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the FastPicker plugin for WordPress. The plugin functions as an order picker and order management system (OMS) for WooCommerce. All versions up to and including 1.0.2 are affected.
The vulnerability stems from missing or incorrect nonce validation on the settingsPage function. Unauthenticated attackers can modify the plugin's settings if they trick an authenticated site administrator into clicking a crafted link. Affected settings include toggling the webhook integration and changing the FastPicker and KDZ API URLs.
Critical Impact
Successful exploitation lets attackers redirect order management API traffic to attacker-controlled endpoints by altering plugin configuration without administrator consent.
Affected Products
- FastPicker plugin for WordPress (versions up to and including 1.0.2)
- WooCommerce installations integrating the FastPicker order management system
- WordPress sites using the FastPicker webhook and KDZ API integrations
Discovery Timeline
- 2026-06-09 - CVE CVE-2026-8904 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-8904
Vulnerability Analysis
The FastPicker plugin exposes a settings page handler that processes administrative configuration changes without validating a WordPress nonce token. WordPress nonces are intended to confirm that a state-changing request originated from a legitimate in-session user action. When the settingsPage function omits this check, the plugin accepts any POST request that reaches an authenticated administrator's browser.
An attacker hosts a malicious page or sends a link that triggers a forged POST request to the FastPicker settings endpoint. If a logged-in administrator visits the page, the browser submits the request with valid session cookies. The plugin then updates configuration values, including the webhook integration toggle and the FastPicker and KDZ API URLs.
The issue is classified under CWE-352: Cross-Site Request Forgery. Exploitation requires user interaction from an administrator but no attacker authentication.
Root Cause
The root cause is the absence of nonce validation in the settings save routine. The plugin does not call wp_verify_nonce() or check_admin_referer() before persisting submitted settings. Without this verification, the handler cannot distinguish between an intentional administrator submission and a cross-origin forged request.
Attack Vector
The attack is network-based and requires user interaction. An attacker crafts an HTML form or JavaScript payload that auto-submits to the FastPicker settings URL. The attacker then lures an administrator into visiting the page through phishing, a forum post, or a comment link. On submission, the plugin updates the webhook URL or API endpoints to attacker-controlled servers, redirecting order data and integration callbacks. See the WordPress Plugin Code Review for Settings.php and the Admin.php code reference for the affected handlers.
Detection Methods for CVE-2026-8904
Indicators of Compromise
- Unexpected changes to FastPicker plugin settings, particularly the webhook URL and the FastPicker or KDZ API URL fields.
- Outbound HTTP requests from the WordPress server to unknown third-party domains configured as API endpoints.
- Administrator browser history entries pointing to external pages immediately preceding settings modifications.
Detection Strategies
- Monitor WordPress wp_options table writes for changes to FastPicker configuration keys and compare against an approved baseline.
- Inspect web server access logs for POST requests to the FastPicker settings endpoint that lack a valid Referer header from the WordPress admin dashboard.
- Alert on administrator sessions that submit settings changes within seconds of loading an external referrer.
Monitoring Recommendations
- Enable WordPress audit logging plugins to record all option changes with user, IP address, and timestamp.
- Forward WordPress and web server logs to a centralized analytics platform for correlation across administrator activity.
- Review the Wordfence Vulnerability Report for additional detection signatures.
How to Mitigate CVE-2026-8904
Immediate Actions Required
- Audit the current FastPicker webhook URL and API URL values, and restore known-good configuration if tampering is suspected.
- Restrict administrator browsing habits and require administrators to use separate browser profiles for WordPress administration.
- Deploy a web application firewall rule to block POST requests to FastPicker settings endpoints lacking a same-origin Referer header.
Patch Information
At the time of NVD publication on 2026-06-09, all versions up to and including 1.0.2 are affected. Site administrators should consult the plugin repository for an updated release that adds nonce validation to the settingsPage function and apply it as soon as it becomes available.
Workarounds
- Deactivate the FastPicker plugin until a patched version is released if webhook or API configuration integrity is critical.
- Apply WAF rules that enforce Referer and Origin header checks on the plugin's settings POST endpoint.
- Limit the number of accounts with manage_options capability to reduce the population of administrators that can be targeted.
# Example WAF rule to enforce same-origin Referer on FastPicker settings POSTs
SecRule REQUEST_METHOD "@streq POST" \
"chain,id:1026890401,phase:1,deny,status:403,msg:'FastPicker CSRF protection'"
SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=fastpicker" \
"chain"
SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
