A1POST.BG Shipping for Woo exposes a CSRF weakness that permits an attacker to coerce a logged‑in administrator to perform privileged actions. The flaw enables an unauthorized user to manipulate the shipping plugin’s request flow, resulting in escalation of privileges on the WordPress site.

The plugin ‘A1POST.BG Shipping for Woo’ is affected in all releases up to, and including, version 1.5. Users running any of these versions on a WordPress site are potentially vulnerable.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score of less than 1% indicates a low probability of widespread exploitation, yet the plugin’s core functionality means an attack could impact site security. Because the vulnerability is CSRF‑based, the attacker needs the victim to be authenticated as an administrator; they then send a forged request that exploits the plugin’s lack of CSRF protection. The flaw is not currently listed in CISA’s KEV catalog.