CVE-2023-3507
WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF
MEDIUM 6.5EPSS 0.3%
The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack
- Affected
- WooCommerce Pre-Orders
- CVSS v3.1 NVD
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - EPSS
- 0.31% chance of exploitation in the next 30 days, 22nd percentile
- Published
- 2023-07-31
- Updated
- 2025-04-23