CVE-2026-6932 Details
Description
The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1. This is due to missing nonce verification on the settings update handler in edit-weight.php. This makes it possible for unauthenticated attackers to modify the minimum order weight setting by tricking a site administrator into clicking a link or visiting an attacker-controlled page containing a forged POST request.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Woo Commerce Minimum Weight plugin for WordPress, affecting all versions up to and including 3.0.1. The vulnerability arises from a lack of nonce verification in the settings update handler of edit-weight.php. This flaw allows unauthenticated attackers to alter the minimum order weight setting by deceiving a site administrator into clicking a link or visiting a page controlled by the attacker, which contains a forged POST request.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/browser/woo-commerce-min-weight/tags/3.0.1/edit-weight.php#L3 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/woo-commerce-min-weight/tags/3.0.1/edit-weight.php#L5 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/woo-commerce-min-weight/trunk/edit-weight.php#L3 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/woo-commerce-min-weight/trunk/edit-weight.php#L5 | [email protected] | Broken LinkSource CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c44c95-6a00-4c56-967b-003ce307f90c?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Woo Commerce Minimum Weight | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |