CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector wc-gsheetconnector allows Cross Site Request Forgery.This issue affects WooCommerce Google Sheet Connector: from n/a through <= 1.3.20.
Explanation of Vulnerability in Simple Terms
The WooCommerce Google Sheet Connector plugin contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, triggers unwanted changes to plugin settings or data. The vulnerability affects versions 1.3.20 and earlier. Site owners should update to a version newer than 1.3.20 as soon as available.
What an attacker can do
Trick an admin into visiting a malicious page to perform unauthorized actions on the site.
Potential impact on your site
Plugin settings or connected Google Sheet data could be modified without your knowledge or consent.
Conditions required to exploit
Admin must visit attacker-controlled page or click a malicious link while logged in.
Key dates
External resources
Related vulnerabilities
