Attack Vectors

Whatsiplus Scheduled Notification for Woocommerce (slug: whatsiplus-scheduled-notification-for-woocommerce) is affected by a Medium-severity vulnerability (CVSS 4.3) tracked as CVE-2026-1455.

The issue is a Cross-Site Request Forgery (CSRF) in the plugin’s wsnfw_save_users_settings AJAX action. In practical terms, an attacker can attempt to trick a logged-in administrator into clicking a link or loading a web page that silently submits a forged request to your site.

This attack does not require the attacker to log in, but it does rely on administrator interaction (for example, clicking a link in an email, a chat message, or a malicious web page). Because marketing and operations teams frequently interact with inbound links and third-party tools, this is a realistic social-engineering pathway for business sites.

Security Weakness

The vulnerability exists because versions up to and including 1.0.1 lack nonce validation on the wsnfw_save_users_settings AJAX action. A nonce is a common WordPress safeguard designed to confirm that a request is intentionally initiated by an authorized user within the site’s normal workflow.

Without that check, the plugin may accept configuration changes originating from a third-party page, as long as the administrator’s browser is currently authenticated to the WordPress site. This creates a governance gap: a business-critical system can be reconfigured through normal browsing behavior rather than a deliberate administrative action.

At the time of writing, there is no known patch available. That shifts the decision from “apply an update” to “evaluate risk tolerance and implement mitigations,” which should include strong change control for WordPress plugins.

Technical or Business Impacts

The stated impact is unauthorized modification of plugin configuration settings (integrity impact is limited, confidentiality and availability impacts are not indicated in the CVSS vector). Even “limited” configuration changes can create meaningful business risk when a plugin influences customer communications, notifications, or operational workflows.

Business impacts may include: disruption to customer messaging or order-related notifications, inconsistent customer experiences, increased support volume, and brand damage if communications become inaccurate or poorly timed. For compliance and audit teams, unauthorized settings changes also introduce concerns around change management, evidence of control, and incident response documentation.

Recommended actions given “no known patch available” include: considering uninstalling Whatsiplus Scheduled Notification for Woocommerce and replacing it with a supported alternative, reducing administrator browsing risk (separate admin accounts, limited plugin admin access, and cautious link-handling), and monitoring for unexpected configuration changes to the plugin’s settings.

Similar Attacks

CSRF is a long-standing web risk pattern where attackers manipulate an authenticated user’s browser into making unintended changes. Public examples and references include:

OWASP: Cross-Site Request Forgery (CSRF) (overview and business-relevant risk description).

PortSwigger Web Security Academy: CSRF (real-world mechanics and why “a simple click” can matter).