Blacklist Manager for WooCommerce: Cross-Site Request Forgery (CVE-2026-96838)

Blacklist Manager for WooCommerce (<= 2.3.1) is affected by a CSRF vulnerability (CVE-2026-96838) due to an insecure implementation of the rest_authentication_errors filter. The plugin incorrectly discards WordPress authentication errors when a specific string is present in the request URI. This flaw effectively disables the REST nonce check for all REST routes. An attacker can craft a malicious webpage that, when visited by a logged-in administrator, executes unauthorized REST API calls, such as creating a new administrative account or executing arbitrary code.

Attack Chain

1. Attacker identifies a target site using the vulnerable Blacklist Manager for WooCommerce plugin.
2. Attacker hosts a malicious webpage designed to trigger REST API requests against the target WordPress instance.
3. Attacker lures a logged-in WordPress administrator to the malicious page.
4. Malicious page executes a cross-origin request to the target site's WordPress REST API.
5. The vulnerable rest_authentication_errors filter suppresses the nonce check, authorizing the forged request under the victim's session.
6. The request succeeds, creating a new administrative user account controlled by the attacker.
7. Attacker authenticates with the newly created account to achieve arbitrary PHP execution or further system compromise.

Impact

Successful exploitation allows for full site compromise by enabling unauthorized administrative account creation. This provides a direct path to arbitrary PHP execution and persistent backend access.

Recommendation

• Update the Blacklist Manager for WooCommerce plugin to version 2.3.2 or later immediately.
• Audit administrative user lists for unauthorized accounts created after the vulnerability became public.
• Implement security headers and restrict administrative access to known, trusted IP ranges to mitigate the impact of potential CSRF attacks.