The USB Qr Code Scanner For Woocommerce plugin contains missing nonce validation on its settings page. An unauthenticated attacker can craft a forged request that a logged‑in administrator may inadvertently submit, resulting in the plugin’s configuration being changed. This modification can expose the site to policy violations, data leakage, or other unintended behaviors, although it does not directly compromise the core WordPress installation.

Products affected are the USB Qr Code Scanner For Woocommerce plugin created by behzadrohizadeh. All released versions up to and including 1.0.0 are vulnerable; administrators using any of these releases must take action.

The CVSS score of 4.3 indicates a moderate risk level, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV, but the attack vector relies on an advertised link or form that tricks an administrator into initiating a request. Because the CSRF flaw allows alteration of secure settings, a successful attack can impact the confidentiality and integrity of the site’s configuration. Traditional defensive measures such as proper nonce checks are necessary to mitigate this risk.