CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in WP Trio Conditional Payments for WooCommerce conditional-payments-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Payments for WooCommerce: from n/a through <= 3.3.0.
Explanation of Vulnerability in Simple Terms
Conditional Payments for WooCommerce versions 3.3.0 and earlier contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the plugin's settings or payment configuration without the admin's knowledge or consent. This could lead to disruption of payment processing or unauthorized changes to payment rules.
What an attacker can do
Trick a site admin into visiting a malicious page that changes payment settings or disables payment processing.
Potential impact on your site
Payment processing could be disrupted or misconfigured without your knowledge if an admin visits a compromised site.
Conditions required to exploit
Admin must be logged in and click a malicious link or visit an attacker-controlled page.
Key dates
External resources
Related vulnerabilities
