CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Josh Kohlbach Product Feed PRO for WooCommerce woo-product-feed-pro allows Cross Site Request Forgery.This issue affects Product Feed PRO for WooCommerce: from n/a through <= 13.5.2.
Explanation of Vulnerability in Simple Terms
Product Feed PRO for WooCommerce versions up to 13.5.2 contain a cross-site request forgery (CSRF) vulnerability. An attacker can trick a site administrator into performing unwanted actions by visiting a malicious webpage while logged in. The vulnerability allows modification of plugin settings or data without the admin's knowledge or consent.
What an attacker can do
Trick a logged-in admin into modifying plugin settings or data by visiting a malicious webpage.
Potential impact on your site
Attackers can alter product feed configuration, potentially disrupting WooCommerce product data exports or integrations.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special privileges required.
Key dates
External resources
Related vulnerabilities
