Plugin SearchAzon de WordPress <= 1.4 - Vulnerabilidad de Cross Site Request Forgery (CSRF)

A successful CSRF attack could allow an attacker to modify settings, add or remove products, or perform other actions as the logged-in user without their knowledge or consent. This could lead to data corruption, unauthorized changes to the website’s functionality, or even account takeover. The impact is particularly severe if the website administrator account is targeted, as this could grant the attacker full control over the WordPress site. While CSRF attacks typically require social engineering to trick a user into clicking a malicious link, the ease of exploitation makes this a significant risk, especially for sites with a large user base.

Websites using the SearchAzon plugin, particularly those with user accounts and sensitive data, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a vulnerability in one site could potentially be exploited to compromise others.

• wordpress / composer / npm:

grep -r 'searchazon.com/api/' /var/www/html/wp-content/plugins/

• generic web:

curl -I https://your-wordpress-site.com/ | grep -i 'csrf-token'

1. 2026-01-22Disclosure

   disclosure

1. Reservado2026-01-07
2. Publicada2026-01-22
3. Modificada2026-04-28
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-22360 is to upgrade to a patched version of the SearchAzon plugin as soon as it becomes available. Until the patch is released, consider implementing additional security measures such as enabling CSRF protection in WordPress itself (if not already enabled) and using a Web Application Firewall (WAF) that can detect and block CSRF attacks. Carefully review any plugin updates or changes before applying them to minimize the risk of introducing new vulnerabilities. Monitor website logs for suspicious activity that might indicate a CSRF attempt.