CVE-2026-57758: BeRocket Permalink Manager for WooCommerce CSRF to Stored XSS

CVE-2026-57758 · Severity: high · CVSS 7.1 · Published 2026-07-02

A vulnerability exists in the Permalink Manager for WooCommerce plugin, which is used to customize website link structures for online stores. An attacker could trick a site administrator into performing unintended actions, such as changing site settings or injecting malicious scripts, by getting them to click a specially crafted link. This could lead to unauthorized changes to the store's configuration or the compromise of administrative accounts.

Vendors: BeRocket.

Quick answers

Is CVE-2026-57758 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57758 being exploited in the wild.
How severe is CVE-2026-57758?
High severity, with a CVSS score of 7.1, published 2 July 2026.
Which products and versions are affected?
BeRocket Permalink Manager for WooCommerce <= 1.0.8.2.
Is there a fix for CVE-2026-57758?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57758 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57758?
Check whether you run BeRocket Permalink Manager for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the BeRocket Permalink Manager for WooCommerce plugin through version 1.0.8.2. The issue stems from a lack of proper nonce validation on sensitive administrative functions, allowing an unauthenticated attacker to craft a malicious request. If a logged-in administrator interacts with a malicious link or page, the attacker can trigger actions on their behalf, potentially leading to Stored Cross-Site Scripting (XSS). As of the advisory date, no official patch has been released, and users are advised to exercise caution with administrative sessions.

Affected products

  • BeRocket Permalink Manager for WooCommerce <= 1.0.8.2

Timeline

  • 2026-05-10: disclosed: Reported by dodoh4t
  • 2026-07-02: advisory: Published by Patchstack and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.