Live › vulnerability › CVE-2026-119466
The APIExperts Square for WooCommerce plugin, a WordPress add-on that connects WooCommerce stores to Square, has a cross-site request forgery flaw affecting versions through 4.7.5. An attacker can trick a logged-in site administrator's browser into sending a request the plugin accepts, so the attacker can change plugin settings or actions without the admin knowing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 17:31 UTC. All times on this page are UTC.
Sites running the woosquare WordPress plugin at version 4.7.5 or earlier that connects WooCommerce to Square. The risk depends on a logged-in administrator visiting an attacker-controlled page while signed in; sites without this plugin are not affected. The sources do not give the exact vulnerable endpoint or the required privilege level.
No product ranges from the sources yet.
woosquare) in the WordPress admin under Plugins.4.7.5 or earlier.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-119466")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.