CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Awin Awin – Advertiser Tracking for WooCommerce awin-advertiser-tracking allows Cross Site Request Forgery.This issue affects Awin – Advertiser Tracking for WooCommerce: from n/a through <= 2.0.0.
Explanation of Vulnerability in Simple Terms
The Awin Advertiser Tracking for WooCommerce plugin through version 2.0.0 is vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious link or webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the administrator's knowledge or consent. This could allow unauthorized changes to plugin settings or affiliate tracking configuration.
What an attacker can do
Trick a site admin into visiting a malicious page that performs unwanted actions on the site.
Potential impact on your site
Unauthorized changes to affiliate tracking settings or plugin configuration if an admin visits a malicious link.
Conditions required to exploit
Admin must visit attacker-controlled page while logged into WordPress.
Key dates
External resources
Related vulnerabilities
