A Cross‑Site Request Forgery vulnerability exists in the Awin – Advertiser Tracking for WooCommerce plugin that allows an attacker who can trick an authenticated user into visiting a crafted URL to force the regeneration of the product feed. This action can modify data presented to customers or disrupt e‑commerce operations without the victim’s consent. The weakness is identified as CWE‑352, leading to a moderate severity rating of CVSS 4.3.

The vulnerability affects the Awin – Advertiser Tracking for WooCommerce WordPress plugin with versions up to and including 2.0.0. Any WordPress site using this plugin and an affected version is potentially exposed.

The CVSS score of 4.3 indicates medium risk, and the EPSS score of less than 1% suggests that widespread exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, but the nature of a CSRF flaw means that a malicious actor could exploit it by luring an authenticated administrator or staff member into clicking a malicious link or by embedding the request in a page the victim views. The attacker would need the victim to be logged in with sufficient privileges to trigger the feed regeneration endpoint.