A Cross‑Site Request Forgery flaw exists in the WordPress plugin Product Author for WooCommerce that allows a malicious actor to compel an authenticated site user to execute privileged actions within the plugin, such as altering product data or settings, without the user’s consent. The flaw is a classic example of a missing anti‑CSRF token and is classified as CWE‑352. This vulnerability can occur when an attacker supplies a forged request that the plugin accepts as legitimate.

WordPress installations that have the Product Author for WooCommerce plugin version 1.0.7 or earlier are affected. All releases from the plugin's inception through and including 1.0.7 expose the flaw.

The CVSS score of 4.3 indicates a moderate surface, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to be logged in to the WordPress admin interface and for the attacker to embed and trigger the forged request, typically via a crafted link or social‑engineering technique. The attack vector is therefore network‑accessible and contingent on user interaction.