CVE-2025-54030
Lifecycle Timeline
2Tags
Description
Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector wc-gsheetconnector allows Cross Site Request Forgery.This issue affects WooCommerce Google Sheet Connector: from n/a through <= 1.3.20.
Analysis
Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector plugin versions up to 1.3.20 allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated WordPress administrators. The plugin fails to implement proper CSRF token validation on critical functionality, enabling attackers to craft malicious requests that execute actions without explicit user consent. Although EPSS scoring indicates low exploitation probability (0.02%), CSRF vulnerabilities targeting WordPress admin functions represent a meaningful risk in multi-admin environments where social engineering can trick administrators into visiting attacker-controlled pages.
Technical Context
The WooCommerce Google Sheet Connector is a WordPress plugin (CPE: cpe:2.3:a:patchstack:wc-gsheetconnector:*:*:*:*:*:wordpress:*:*) that integrates WooCommerce stores with Google Sheets for data synchronization and reporting. The vulnerability stems from CWE-352 (Cross-Site Request Forgery / CSRF), a failure to implement anti-CSRF tokens (nonces in WordPress terminology) on state-changing operations. WordPress provides the wp_nonce_field() and wp_verify_nonce() functions specifically to mitigate CSRF attacks; the plugin's absence of proper nonce validation on administrative or AJAX endpoints allows an attacker's crafted HTML form or JavaScript request to execute privileged actions (such as modifying connector settings, triggering data syncs, or altering sheet mappings) when a logged-in administrator visits an attacker-controlled webpage.
Affected Products
WesternDeal WooCommerce Google Sheet Connector (plugin slug: wc-gsheetconnector) versions 1.3.20 and earlier are affected. The plugin is distributed via the WordPress.org plugin repository and used in WooCommerce e-commerce installations. No minimum version boundary is documented in available data, meaning all known versions up to and including 1.3.20 are in scope. Affected WordPress environments are those running WooCommerce with this plugin active and exposed to unauthenticated attackers capable of social engineering site administrators.
Remediation
Upgrade WooCommerce Google Sheet Connector to a patched version newer than 1.3.20 as soon as available from the WordPress.org plugin repository or the vendor's official update mechanism. Administrators should check their WordPress admin dashboard (Plugins > Updates) for an available update. If no patched version is yet released, implement immediate workarounds: (1) Restrict administrative access to trusted IP ranges via .htaccess or WAF rules; (2) enforce strong, unique passwords and multi-factor authentication (MFA) on all admin accounts to reduce impact of social engineering; (3) disable or deactivate the plugin temporarily if data synchronization is not actively needed; (4) monitor WooCommerce order and inventory logs for unauthorized changes. Review the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/wc-gsheetconnector/vulnerability/wordpress-woocommerce-google-sheet-connector-plugin-1-3-20-cross-site-request-forgery-csrf-vulnerability for patched version details upon release.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today