CVE-2026-22360: CSRF in SearchAzon WordPress Plugin

A successful CSRF attack could allow an attacker to modify settings, add or remove products, or perform other actions as the logged-in user without their knowledge or consent. This could lead to data corruption, unauthorized changes to the website’s functionality, or even account takeover. The impact is particularly severe if the website administrator account is targeted, as this could grant the attacker full control over the WordPress site. While CSRF attacks typically require social engineering to trick a user into clicking a malicious link, the ease of exploitation makes this a significant risk, especially for sites with a large user base.

1. Reserved2026-01-07
2. Published2026-01-22
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-22360 is to upgrade to a patched version of the SearchAzon plugin as soon as it becomes available. Until the patch is released, consider implementing additional security measures such as enabling CSRF protection in WordPress itself (if not already enabled) and using a Web Application Firewall (WAF) that can detect and block CSRF attacks. Carefully review any plugin updates or changes before applying them to minimize the risk of introducing new vulnerabilities. Monitor website logs for suspicious activity that might indicate a CSRF attempt.