APIExperts Square EUVD-2026-114190

Exploitation requires a victim who is already authenticated to the WordPress site (typically an administrator with access to the plugin's functionality) to be tricked into interacting with attacker-controlled content (UI:R) - for example, clicking a crafted link or loading a malicious page while logged in. The attacker needs no account or credentials on the target (PR:N) and no special server configuration is stated. Limiting factors: the attack fails without a logged-in, sufficiently privileged victim performing the interaction, and the specific plugin action exploited and whether default configurations are affected are not described in the available sources. Impact is confined to partial integrity and availability (no confidentiality loss).

This is a medium-severity CSRF flaw (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) in the APIExperts Square for WooCommerce (woosquare) WordPress plugin, reported by Patchstack. The CVSS vector shows network reach with no attacker privileges required (PR:N) but mandatory user interaction (UI:R), which is consistent with CWE-352: the attacker does not authenticate to the target but must lure an already-authenticated victim (typically an administrator) into triggering a forged request. Impact is limited to partial integrity and availability (I:L/A:L) with no confidentiality loss (C:N), so this is not a data-disclosure or full-takeover issue on its own. No EPSS score, CISA KEV listing, or confirmed proof-of-concept was supplied in the input, so there is no signal of active or probable exploitation; the vuln.today decision label is 'this_month' rather than act_now/emergency. Net assessment: a real but moderate-priority issue - the unauthenticated network vector is offset materially by the user-interaction requirement and the limited I:L/A:L impact. The absence of EPSS and KEV data is a genuine gap: exploitation likelihood cannot be quantified from the provided signals, only bounded by the CSRF mechanics.

An attacker crafts a malicious web page or email containing a forged request targeting the woosquare plugin and lures a logged-in WordPress administrator into visiting it. Because the plugin action lacks CSRF nonce validation, the victim's browser submits the state-changing request with their valid session, altering plugin configuration or data (partial integrity/availability impact). No public exploit code was identified in the provided data; the single reference is the Patchstack advisory, not a working exploit.