CVE-2026-96838

Summary

The flaw is an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the Blacklist Manager for WooCommerce Anti-Fraud versions 2.3.1 and earlier, allowing attackers to perform unauthorized actions on behalf of users.

Exploitability

Exploitation is relatively easy as it requires an attacker to trick a user into performing an action on a malicious site, making it a significant risk.

Blast radius

If exploited, this could lead to unauthorized changes to the blacklist settings, potentially allowing attackers to bypass fraud detection or manipulate checkout verification processes.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Blacklist Manager version 2.3.2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.