CVE-2026-96838: Critical CSRF in Blacklist Manager for WooCommerce

CVE-2026-96838 identifies an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin, affecting versions up to 2.3.1. The flaw allows an attacker to execute unauthorized actions through forged requests without requiring credentials, potentially compromising thousands of ecommerce stores using this plugin for fraud prevention and checkout verification.

The vulnerability is rated with CVSS 8.8, classified as High severity, as it enables significant impact with limited attack complexity. The National Vulnerability Database (NVD) published the advisory on September 30, 2026. Public proof-of-concept code has been confirmed on GitHub repositories, as reported on November 7, 2026. This indicates the vulnerability is accessible to attackers and defensive measures must be deployed immediately.

System administrators and IT teams must urgently verify which WooCommerce instances are running Blacklist Manager version 2.3.1 or earlier and proceed with upgrades to a patched version as soon as available. Monitor access logs and suspicious activity on WooCommerce checkout pages, including undocumented changes to security settings or blacklist modifications. Consult vendor advisories and prioritize security update rollouts to mitigate exposure.