CyberRota Analysis
AI-GeneratedThe WC Vendors plugin for WordPress prior to version 2.7.2.1 is vulnerable due to a lack of CSRF protection on front-end order shipment status actions, enabling attackers to manipulate shipment statuses of orders by sending crafted requests to logged-in vendors. This vulnerability poses a medium risk as it could lead to unauthorized changes in order management, potentially impacting vendor operations and customer trust. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.