Cross-Site Request Forgery in eCommerce Product Catalog Plugin for WordPress

CVE-2021-4393

Summary

The eCommerce Product Catalog Plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF) due to inadequate nonce validation within the save() function. This vulnerability allows attackers to execute unauthorized actions, such as saving orders, by tricking an unsuspecting site administrator into clicking a malicious link. Proper nonce validation is essential to ensure that requests originate from legitimate users, and the absence of this check exposes the plugin and its users to potential exploitation.

References