The FastPicker plugin for WordPress suffers from a CSRF flaw due to missing or incorrect nonce validation in its settingsPage function. An attacker who tricks an administrator into visiting a crafted URL can alter the plugin’s configuration, toggling webhook integration and redefining FastPicker and KDZ API endpoints. This compromise can redirect traffic, change API calls, or enable further compromise of the WooCommerce store.

vulnerable versions of the FastPicker plugin—any release up to and including 1.0.2—can be installed on WordPress sites running WooCommerce. The flaw exposes the plugin’s settings pages to unauthorized changes, affecting sites that use this order picker and order management system.

With a CVSS score of 4.3 the flaw presents a moderate risk. No EPSS data is available and the vulnerability is not in CISA’s KEV catalog. If the site administrator is logged in when visiting a malicious link, the attacker can exploit the flaw; the required conditions include an authenticated admin session and the ability to embed a forged request in a link or email. The attack vector is inferred from the description, which indicates the need for an admin to click a link that delivers the CSRF payload.