CVE-2026-39671: 
WordPress vulnerability analysis and mitigation

CVE-2026-39671 is a Cross-Site Request Forgery (CSRF) vulnerability in the Dotstore Extra Fees Plugin for WooCommerce (woo-conditional-product-fees-for-checkout), a WordPress plugin used to configure conditional checkout fees. The vulnerability affects all plugin versions through 4.3.3 and was disclosed on April 8, 2026, by Patchstack. It carries a CVSS v3.1 base score of 7.1 (High), as assessed by both Patchstack and CISA-ADP (GitHub Advisory).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to sufficiently verify that state-changing requests were intentionally submitted by an authenticated user. An attacker can craft a malicious web page or link that, when visited by an authenticated WooCommerce administrator, silently submits forged requests to the plugin's endpoints — requiring no privileges on the attacker's part, only user interaction from the victim. The attack vector is network-based with low complexity, and no authentication is required from the attacker's side (GitHub Advisory).

Successful exploitation allows an attacker to perform unauthorized actions on behalf of authenticated WooCommerce administrators, including modifying plugin settings, altering fee configurations, and changing checkout processes without the victim's knowledge or consent. This can result in unauthorized pricing changes, manipulation of store checkout flows, and disruption of e-commerce operations. The impact spans low confidentiality exposure, low integrity degradation, and low-to-high availability impact depending on the scoring source (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000080), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Dotstore Extra Fees Plugin for WooCommerce at version 4.3.3 or earlier, using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Craft malicious request: Construct an HTML page or form that automatically submits a POST request to the vulnerable plugin endpoint (e.g., a settings update action) with attacker-controlled parameters, exploiting the absence of CSRF nonce validation.
3. Deliver to victim: Lure an authenticated WooCommerce administrator into visiting the malicious page via phishing email, social engineering, or a compromised third-party site.
4. Trigger forged action: When the administrator's browser loads the page, the forged request is submitted with their session credentials, causing the plugin to process the unauthorized action — such as modifying fee rules or disabling checkout conditions — without any indication to the victim.

• Logs: WordPress access logs showing unexpected POST requests to plugin admin endpoints (e.g., wp-admin/admin-ajax.php or plugin-specific action URLs) from unusual referrer origins or with missing/invalid nonce values.
• Application: Unexplained changes to Extra Fees Plugin settings, fee rules, or WooCommerce checkout configurations without corresponding administrator activity.
• Network: Requests to WooCommerce admin endpoints originating from external or unexpected referrer domains, particularly those lacking a valid WordPress nonce token in the request body.

Update the Dotstore Extra Fees Plugin for WooCommerce to a version newer than 4.3.3, which contains the fix for this CSRF vulnerability (GitHub Advisory). As interim mitigations, administrators should enforce nonce validation in WooCommerce forms, implement HTTP Referer header validation, and restrict administrative access to trusted networks. Deploying a Web Application Firewall (WAF) with rules to detect and block suspicious cross-site requests can provide additional defense-in-depth.