Extra Fees Plugin For Woocommerce
Monthly
Cross-Site Request Forgery in Dotstore Extra Fees Plugin for WooCommerce versions through 4.3.3 allows remote attackers to execute unauthorized administrative actions on behalf of authenticated WordPress administrators by tricking them into visiting malicious websites or clicking crafted links. The vulnerability enables attackers to modify plugin settings, create unauthorized fees, or alter checkout configurations without the administrator's knowledge. While no active exploitation is confirmed (CISA KEV absent) and EPSS probability is minimal (0.01%, 1st percentile), the CVSS score of 7.1 reflects potential for broad impact across WordPress e-commerce sites using this plugin.
Cross-Site Request Forgery in Dotstore Extra Fees Plugin for WooCommerce versions through 4.3.3 allows remote attackers to execute unauthorized administrative actions on behalf of authenticated WordPress administrators by tricking them into visiting malicious websites or clicking crafted links. The vulnerability enables attackers to modify plugin settings, create unauthorized fees, or alter checkout configurations without the administrator's knowledge. While no active exploitation is confirmed (CISA KEV absent) and EPSS probability is minimal (0.01%, 1st percentile), the CVSS score of 7.1 reflects potential for broad impact across WordPress e-commerce sites using this plugin.