The vulnerability is a CSRF flaw that permits an attacker to trigger unauthorized changes to the plugin settings without the user’s consent. A single forged request could alter pricing rules, potentially leading to loss of revenue, mispricing, or undesired transaction behavior. The weakness aligns with CWE-352 and is limited to the advanced‑dynamic‑pricing‑for‑woocommerce plugin code.

The affected product is the Advanced Dynamic Pricing for WooCommerce plugin by algol.plus, versions from n/a through 4.9.3. Users running any version less than or equal to 4.9.3 are impacted.

With a CVSS score of 4.3 the risk is moderate, compounded by an EPSS score of less than 1%, indicating very low exploitation probability. The vulnerability is not in the CISA KEV list. It is inferred that attackers can exploit it by creating a malicious site that submits a forged POST request to the plugin’s settings endpoint, provided the user is authenticated and holds sufficient privileges. No additional access or privilege escalation is required beyond normal user or administrative credentials.