CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Metorik Metorik – Reports & Email Automation for WooCommerce metorik-helper allows Cross Site Request Forgery.This issue affects Metorik – Reports & Email Automation for WooCommerce: from n/a through <= 1.7.1.
Explanation of Vulnerability in Simple Terms
Metorik for WooCommerce versions up to 1.7.1 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the Metorik plugin without the admin's knowledge or consent. The vulnerability requires the victim to click the link or visit the attacker's page.
What an attacker can do
Perform unwanted actions in Metorik on behalf of a logged-in administrator.
Potential impact on your site
An attacker could modify Metorik settings, reports, or automation rules by tricking your admin into visiting a malicious page.
Conditions required to exploit
Administrator must visit attacker-controlled page or click a malicious link while logged in.
Key dates
External resources
Related vulnerabilities
