The LitExtension WordPress plugin, versions up through 1.2.5, fails to verify a nonce before executing an administrative action that overwrites the store‑migration connector’s authentication token. An attacker who successfully lures a logged‑in administrator to click a crafted link can cause that administrator to unknowingly replace the token, effectively taking control of the connector’s authenticated session. This flaw allows the attacker to perform actions normally restricted to legitimate administrators, potentially compromising data migration operations, credentials, and the integrity of migrated content.

LitExtension’s Store to WooCommerce Migration plugin for WordPress, versions up to and including 1.2.5. The vulnerability resides in the connector configuration component that manages authentication tokens for migrating data between e‑commerce platforms.

The CVSS score of 4.2 indicates moderate severity. EPSS is unavailable, and the vulnerability is not listed in CISA KEV. The weakness can be exploited via a cross‑site request forgery vector that requires a legitimate administrator to visit an attacker‑crafted URL. Social engineering or phishing techniques that prompt an administrator to click a lure link represent the primary attack path. While the impact is significant for accounts with management privileges over the migration connector, the lack of automatic execution or network reachability limits widespread exploitation, keeping the overall risk moderate.