{"id":"CVE-2026-119466","kind":"vulnerability","aliases":["CVE-2026-119466"],"related":[],"title":"WooCommerce Square plugin: cross-site request forgery through version 4.7.5","description":"Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.","summary":"The APIExperts Square for WooCommerce plugin, a WordPress add-on that connects WooCommerce stores to Square, has a cross-site request forgery flaw affecting versions through 4.7.5. An attacker can trick a logged-in site administrator's browser into sending a request the plugin accepts, so the attacker can change plugin settings or actions without the admin knowing.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","square","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","version-above-4.7.5"],"how_to_check":"- Check the installed version of the APIExperts Square for WooCommerce plugin (`woosquare`) in the WordPress admin under Plugins.\n- Confirm whether the installed version is `4.7.5` or earlier.","fix":null,"status":"open","published_at":"2026-10-30T17:17:19+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:11+00:00","updated_at":"2026-10-30T17:32:11+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T17:32:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WooCommerce Square plugin: cross-site request forgery through version 4.7.5","impact":"medium","summary":"The APIExperts Square for WooCommerce plugin, a WordPress add-on that connects WooCommerce stores to Square, has a cross-site request forgery flaw affecting versions through 4.7.5. An attacker can trick a logged-in site administrator's browser into sending a request the plugin accepts, so the attacker can change plugin settings or actions without the admin knowing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","square","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Plugin settings changed through a forged request from a logged-in admin","analyst_note":"","how_to_check":"- Check the installed version of the APIExperts Square for WooCommerce plugin (`woosquare`) in the WordPress admin under Plugins.\n- Confirm whether the installed version is `4.7.5` or earlier.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-above-4.7.5"],"who_is_affected":"Sites running the woosquare WordPress plugin at version 4.7.5 or earlier that connects WooCommerce to Square. The risk depends on a logged-in administrator visiting an attacker-controlled page while signed in; sites without this plugin are not affected. The sources do not give the exact vulnerable endpoint or the required privilege level.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4131,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119466':14A,17A '-2026':13A,16A '4.7.5':11A,53B,114C 'accept':72B 'action':81B 'add':34B 'add-on':33B 'admin':84B 'administr':63B 'affect':50B,106C 'allow':100C 'apiexpert':26B,95C,107C 'attack':55B,75B 'browser':65B 'chang':77B 'connect':37B 'cross':5A,45B,87C,101C 'cross-sit':4A,44B,86C 'csrf':91C 'cve':12A,15A 'flaw':49B 'forgeri':8A,48B,90C 'forgery.this':104C 'host':21B 'issu':105C 'know':85B 'log':60B 'logged-in':59B 'n/a':112C 'packag':18B 'plugin':3A,30B,71B,78B 'request':7A,47B,69B,89C,103C 'self':20B 'self-host':19B 'send':67B 'set':79B 'site':6A,46B,62B,88C,102C 'squar':2A,22B,27B,41B,96C,108C 'store':39B 'trick':57B 'version':10A,51B 'vulner':92C 'without':82B 'woocommerc':1A,23B,29B,38B,98C,110C 'woosquar':99C 'wordpress':24B,32B 'wpexpert':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the woosquare WordPress plugin at version 4.7.5 or earlier that connects WooCommerce to Square. The risk depends on a logged-in administrator visiting an attacker-controlled page while signed in; sites without this plugin are not affected. The sources do not give the exact vulnerable endpoint or the required privilege level.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119466","severity":null,"published_at":"2026-10-30T17:17:19+00:00","modified_at":"2026-10-30T17:18:40+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}