CVE-2026-8419
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Missing nonce validation in Amazon Scraper plugin for WordPress (up to 1.1) allows CSRF attacks, enabling unauthenticated attackers to update settings and inject malicious scripts.
Risk Assessment
Attackers can take over plugin settings and inject scripts, leading to data theft or further attacks on users.
Recommendation
Update the Amazon Scraper plugin to the latest version and implement nonce validation in all forms.
Original NVD description (English source)
The Amazon Scraper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.