CVE-2026-4843 — The GSheet For Woo Importer plugin for WordPress is

title: GSheet For Woo Importer - Unauthorized Token Deletion - CVE-2026-4843
id: scw-2026-05-21-ai-1
status: experimental
level: medium
description: |
  Detects the specific AJAX action 'gsheet_woo_importer_process_ajax_restore_action' being called via '/wp-admin/admin-ajax.php' with a 200 status code. This corresponds to the vulnerable function process_ajax_restore_action() in the GSheet For Woo Importer plugin, which can be exploited by authenticated users (Subscriber level and above) to delete the plugin's Google Sheets API token and configuration options, leading to unauthorized data loss. This rule targets the core vulnerability described in CVE-2026-4843.
author: SCW Feed Engine (AI-generated)
date: 2026-05-21
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-4843/
tags:
  - attack.impact
  - attack.t1531
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=gsheet_woo_importer_process_ajax_restore_action'
  selection_base:
      sc-status:
          - 200
  condition: selection AND selection_base
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse