WordPress Blacklist Manager plugin: Cross-Site Request Forgery (CSRF)

Summary

The WordPress plugin Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification up to and including version 2.3.1 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can lure a logged-in user, such as a shop administrator, to a malicious page that triggers actions the user did not intend. No login is needed by the attacker, but a privileged user must visit the malicious page while logged in. The exact actions reachable through this flaw have not been verified.

Affected

• Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification (WordPress plugin, slug wc-blacklist-manager)
• Versions up to and including 2.3.1

Fixed in

• Version 2.3.2, according to the CVE record and the Patchstack advisory
• The WordPress.org changelog lists version 2.3.4 (15 Oct 2026), but its entries do not mention CSRF, so it is not confirmed to fix this CVE

Workaround

Unknown. No vendor workaround was found.

• Log out of the WordPress admin area when browsing other websites
• Use a separate browser profile for admin work

Exploitation

• CISA SSVC assessment: exploitation none, not automatable, partial technical impact
• No public proof of concept or evidence of exploitation found in the sources checked
• Not listed in the CISA KEV alert of 13 October 2026

Our recommendation

• Check whether any site runs wc-blacklist-manager version 2.3.1 or older
• Update to version 2.3.2 or later and verify the installed version
• Review the blocklist for unexpected entries, especially if a privileged user visited unknown websites while logged in
• If an update is not possible, contact the vendor YoOhw Studio and restrict admin browsing sessions

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-96838 patchstack.com
• Strix CVE record CVE-2026-96838 www.strix.ai
• WordPress.org plugin page wc-blacklist-manager wordpress.org
• CISA KEV alert 13 October 2026 www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:08.