The Kirim.Email WooCommerce Integration plugin suffers from a missing nonce check on its settings page, enabling Cross‑Site Request Forgery. An attacker can submit a crafted request to the settings endpoint, allowing the unauthorized alteration of the plugin's API credentials and integration settings. This could compromise downstream email service access or redirect communications, as the injected changes occur without the site administrator’s explicit confirmation.

The vulnerability exists in all releases of the Kirim.Email WooCommerce Integration WordPress plugin up to and including version 1.2.9. Versions newer than 1.2.9 have added nonce validation to the settings page.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests that active exploitation is presently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require an administrator to be tricked into submitting a forged request, as the description states that an unauthenticated attacker can compel a site administrator to click a link, but no active exploit is reported at this time.