CVE-2026-39671: CSRF in Extra Fees Plugin for WooCommerce

This CSRF vulnerability allows an attacker to trick a logged-in user into unknowingly performing actions they did not intend. For example, an attacker could craft a malicious link that, when clicked by a user with administrative privileges, modifies plugin settings, creates fraudulent fees, or potentially compromises other WooCommerce functionalities. The blast radius extends to any user with access to the WooCommerce admin panel, as an attacker could leverage this vulnerability to escalate privileges and gain control over the e-commerce store. Successful exploitation could lead to financial losses, data breaches, and reputational damage.

1. Reserved2026-04-07
2. Published2026-04-08
3. Modified2026-04-29
4. EPSS updated2026-04-15

The primary mitigation is to upgrade the Extra Fees Plugin for WooCommerce to version 4.3.4 or later. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include strict input validation on all user-supplied data, implementing CSRF tokens on all sensitive actions within the plugin's admin interface, and utilizing a Web Application Firewall (WAF) with CSRF protection rules. Monitor WooCommerce logs for suspicious activity, particularly requests originating from unfamiliar sources. After upgrading, confirm the fix by attempting to trigger a fee creation or modification via a crafted URL – it should be rejected.

Active installs

8KKnown

Plugin rating

4.3

Requires WordPress

5.0+

Compatible up to

6.9.4

Requires PHP

7.2+