CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Cross Site Request Forgery.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through <= 4.9.3.
Explanation of Vulnerability in Simple Terms
Advanced Dynamic Pricing for WooCommerce versions up to 4.9.3 contain a cross-site request forgery vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the pricing plugin without the admin's knowledge. The vulnerability requires user interaction and does not expose sensitive data, but can modify site settings.
What an attacker can do
Trick a site admin into visiting a malicious page that changes pricing settings without their consent.
Potential impact on your site
Pricing rules could be altered unexpectedly if an admin visits a compromised or malicious website while logged in.
Conditions required to exploit
Admin must be logged in and click a malicious link or visit an attacker-controlled page.
Key dates
External resources
