CVE Catalog
CVE-2023-3507
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk0.26%
17th percentile - higher than 17% of all known CVEs
Summary
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders.
Risk Assessment
Attackers could exploit this vulnerability to manipulate pre-orders, potentially leading to financial losses and loss of customer trust.
Recommendation
It is recommended to update the WooCommerce Pre-Orders plugin to version 2.0.3 or later to mitigate this security issue.
Original NVD description (English source)
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack