Executive brief
FastPicker, a WordPress plugin used for managing WooCommerce orders, contains a security flaw that allows unauthorized changes to its configuration. By tricking a site administrator into clicking a malicious link, an attacker can remotely modify plugin settings, such as changing API connections or disabling webhook integrations. This could disrupt order processing workflows and redirect business data to attacker-controlled servers.
Technical details
The FastPicker plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the settingsPage function. This vulnerability exists in all versions up to and including 1.0.2. An unauthenticated attacker can exploit this by inducing a site administrator to perform an action, such as clicking a link, which triggers a forged request to the vulnerable component. Successful exploitation allows the attacker to modify the plugin's settings, including toggling webhook integrations and altering the FastPicker and KDZ API URLs. This is classified as CWE-352.
Affected products
- FastPicker FastPicker up to, and including, 1.0.2
Timeline
- 2026-06-09: disclosed: Initial publication of the CVE record.
- 2026-06-09: advisory: Wordfence published the vulnerability details.