This CVE describes a cross‑site request forgery flaw in the CleverReach Official CleverReach Plugin for WooCommerce. The flaw allows an attacker to send a forged HTTP request that targets the plugin’s settings endpoint without the user’s explicit consent. The CVE description notes that the flaw can change settings, suggesting that an attacker could alter the plugin configuration if they can trick an authenticated user into submitting a request. This outcome is inferred from the wording rather than directly asserted.

All installations of CleverReach’s Official CleverReach Plugin for WooCommerce from the initial release up to and including 3.4.6 are affected. The plugin is widely deployed on WordPress sites running WooCommerce, so any site using a vulnerable version is included in the scope.

The CVSS score of 6.5 rates the vulnerability as medium severity. The EPSS score is below 1 %, indicating that exploitation is unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is CSRF, which would need an attacker to persuade an authenticated user to visit a crafted link or form. This inference is drawn from the description, which states that the flaw permits changes to settings through a forged request.