CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Notify Updated Product woocommerce-notify-updated-product allows Stored XSS.This issue affects Woocommerce Notify Updated Product: from n/a through <= 1.6.
Explanation of Vulnerability in Simple Terms
The Woocommerce Notify Updated Product plugin through version 1.6 lacks CSRF (cross-site request forgery) protection on key actions. An attacker can craft a malicious link or page that, when visited by a logged-in site admin, performs unwanted changes to product notifications without the admin's knowledge or consent. No special privileges or user interaction beyond visiting a page are required.
What an attacker can do
Perform unauthorized actions on product notifications by tricking a logged-in admin into visiting a malicious page.
Potential impact on your site
Product notification settings can be altered without your knowledge, potentially disrupting customer communications or exposing sensitive data.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled page; no authentication required from the attacker.
Key dates
External resources
Related vulnerabilities
