CVE-2026-6932: HEMANT29 Woo Commerce Minimum Weight

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1. This is due to missing nonce verification on the settings update handler in edit-weight.php. This makes it possible for unauthenticated attackers to modify the minimum order weight setting by tricking a site administrator into clicking a link or visiting an attacker-controlled page containing a forged POST request.

Affected products

• HEMANT29 Woo Commerce Minimum Weight: up to and including 3.0.1

Published 2026-05-12. Last modified 2026-06-17.