CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
The USB Qr Code Scanner For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation on the settings page. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
The USB QR Code Scanner for WooCommerce plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, executes unintended operations within the plugin. The vulnerability affects all versions up to 1.0.0. Site owners should update to a patched version when available.
What an attacker can do
Trick an admin into performing unauthorized actions via a malicious link or page.
Potential impact on your site
Attackers can modify plugin settings or data without your knowledge if you click a malicious link.
Conditions required to exploit
Admin must visit attacker-controlled page or click a malicious link while logged in.
Key dates
External resources
