The vulnerability is a CSRF flaw that allows an attacker to trick an authenticated user into submitting forged requests to the WordPress site. Based on the description, it is inferred that a malicious actor could modify payment conditions, potentially altering checkout flows or misdirecting transactions, thereby compromising the integrity of the site’s payment logic.

WP Trio Conditional Payments for WooCommerce plugin, version 3.3.0 or earlier, is affected.

The CVSS base score of 6.5 indicates a moderate severity. The extremely low EPSS score (<1%) suggests that automated exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the attack requires an authenticated session and a user to interact with the site, the attack vector is likely through the standard web interface. An attacker could craft a malicious link or embed a forged form that the victim inadvertently submits while logged into the site, triggering unintended changes to payment settings.