CVE-2025-62080
Lifecycle Timeline
2Tags
Description
Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Cross Site Request Forgery.This issue affects Live Shopping & Shoppable Videos For WooCommerce: from n/a through <= 2.2.0.
Analysis
Cross-Site Request Forgery (CSRF) vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce plugin version 2.2.0 and earlier allows unauthenticated attackers to perform unwanted actions on behalf of authenticated users through forged requests. The vulnerability affects the WordPress plugin used to enable live shopping and shoppable video streams in WooCommerce stores. No public exploit code has been identified, and the EPSS score of 0.02% indicates low exploitation probability despite the CSRF attack vector.
Technical Context
This is a classic Cross-Site Request Forgery (CWE-352) vulnerability in a WordPress WooCommerce plugin. CSRF flaws occur when an application does not properly validate that requests originate from legitimate users, allowing attackers to craft malicious links or forms that execute unintended actions when visited by authenticated users. The Channelize.io Live Shopping plugin integrates live video streaming with WooCommerce commerce functionality; lack of CSRF token validation in its endpoints means attackers can potentially manipulate live shopping operations, modify video stream settings, or trigger unauthorized transactions by tricking logged-in shop administrators or customers into visiting attacker-controlled pages.
Affected Products
Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce plugin (live-shopping-video-streams) in versions 2.2.0 and earlier. The plugin is distributed through the WordPress plugin ecosystem and identified by the WooCommerce product category. Exact CPE designation for WordPress plugins is not standardized, but the vulnerability affects all installations of this plugin on WordPress sites with WooCommerce active.
Remediation
Update the Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce plugin to a version newer than 2.2.0 immediately. Check the plugin's update mechanism within WordPress admin dashboard or contact Channelize.io support at [email protected] for confirmation of patched versions. The primary fix is upgrading beyond the vulnerable version; no workaround is available for CSRF vulnerabilities other than disabling the plugin. Refer to the Patchstack vulnerability database entry (https://patchstack.com/database/Wordpress/Plugin/live-shopping-video-streams/vulnerability/wordpress-live-shopping-shoppable-videos-for-woocommerce-plugin-2-2-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) for vendor remediation timeline and patch availability confirmation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today