CVE-2026-57758

HighCVSS 7.1

Published: 02/07/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.09%

1th percentile — higher than 1% of all known CVEs

Summary

The Permalink Manager for WooCommerce plugin version 1.0.8.2 and earlier contains an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in administrator into performing unintended actions without their knowledge.

Risk Assessment

The risk involves the possibility of unauthorized operations on the administrator account, such as changing permalink settings, which could lead to loss of control over the WooCommerce store's URL structure.

Recommendation

It is recommended to immediately update the Permalink Manager for WooCommerce plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.