CVE-2026-39671

HighCVSS 7.1

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery. This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.

Risk Assessment

Risk of unauthorized actions in the context of a WooCommerce store administrator, such as changing fees or configuration.

Recommendation

It is recommended to update the Extra Fees Plugin for WooCommerce to version 4.3.4 or later.

Other vulnerabilities in Extra Fees Plugin for WooCommerce

CVE-2026-116866High
The Extra Fees Plugin for WooCommerce in versions up to and including 4.4.0 contains a PHP Object Injection vulnerability exploitable by a user with Contributor privileges. The flaw allows injection of a malicious PHP object, potentially leading to further attacks depending on available gadgets.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Dotstore Extra Fees Plugin for WooCommerce woo-conditional-product-fees-for-checkout allows Cross Site Request Forgery.This issue affects Extra Fees Plugin for WooCommerce: from n/a through <= 4.3.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS