Junglewise Threat Intelligence

CVE-2026-8419: Amazon Scraper WordPress plugin CSRF in amazon-admin.php

CVE-2026-8419 · Severity: medium · CVSS 4.3 · Published 2026-05-20

Executive brief

The Amazon Scraper plugin for WordPress, which is used to pull product data from Amazon, contains a security flaw that could allow an attacker to change plugin settings. By tricking a site administrator into clicking a malicious link, an attacker can silently modify configuration or inject scripts. This could lead to unauthorized changes to how the site displays Amazon content or the execution of malicious code in the administrator's browser.

Technical details

The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.1. This vulnerability stems from missing or incorrect nonce validation on functions within the 'amazon-admin.php' file. An unauthenticated attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it (e.g., via social engineering or a malicious link). Successful exploitation allows the attacker to modify plugin settings and potentially inject malicious web scripts (Stored XSS) into the site's configuration.

Affected products

  • Amazon Scraper Team Amazon Scraper Up to, and including, 1.1

Timeline

  • 2026-05-20: disclosed: Initial publication of the CVE record.

References