PT-2026-33055 · WordPress · Product Pricing Table

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-1852

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Product Pricing Table by WooBeWoo versions prior to 1.1.1

Description The Product Pricing Table by WooBeWoo plugin for WordPress is susceptible to Cross-Site Request Forgery. This issue occurs because of missing or incorrect nonce validation in the updateLabel() and remove() functions. An unauthenticated attacker can exploit this by tricking a site administrator into clicking a link, allowing the attacker to inject arbitrary web scripts into pages or delete pricing tables through a forged request.

Recommendations Update to a version later than 1.1.0. As a temporary workaround, restrict access to the updateLabel() and remove() functions to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-1852

Affected Products

Product Pricing Table

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1852 · Security Note
• https://github.com/wpcodefactory/woo-product-pricing-tables/releases/tag/v1.1.1 · Note
• https://twitter.com/VulmonFeeds/status/2044466932158525639 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a3b459e0-4bd9-443e-96e4-91663a35c26e?source=cve · Note
• https://twitter.com/CVEnew/status/2044737987284504735 · Twitter Post