The vulnerability is a classic CSRF flaw that allows an attacker to forge a request that the victim’s browser will unknowingly execute while authenticated. This can lead to unintended changes to the plugin’s configuration or data, potentially affecting store tracking and reporting. The weakness is identified as CWE‑352, which highlights insufficient request validation.

The issue affects the weDevs WooCommerce Conversion Tracking plugin installed in WordPress. All versions up to and including 2.0.10 are vulnerable. Version information starts from the earliest available release up through 2.0.10.

The CVSS score of 4.3 indicates a moderate risk level. EPSS data is not available, so the exploitation probability cannot be precisely quantified but is generally considered low to moderate for CSRF cases. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to persuade an authenticated user to submit a crafted request, making it a user‑agent‑based threat vector.