CVE-2026-24365: CSRF in Stock Manager for WooCommerce

A successful CSRF attack could allow an attacker to modify stock levels, create or delete products, or perform other administrative actions as the logged-in user. The impact is amplified if the targeted user possesses administrative privileges within the WooCommerce store. This could lead to data manipulation, financial loss, or even complete control over the store's inventory and product catalog. While CSRF typically requires social engineering to trick a user into clicking a malicious link, the potential consequences can be significant, especially in e-commerce environments where inventory management is critical.

1. Reserved2026-01-22
2. Published2026-01-22
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24365 is to immediately upgrade the Stock Manager for WooCommerce plugin to version 3.6.0 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. Additionally, ensure that all user accounts utilize strong, unique passwords and that multi-factor authentication (MFA) is enabled wherever possible to reduce the risk of account compromise. Regularly review WooCommerce access logs for suspicious activity.

Active installs

20KNiche

Plugin rating