A Cross‑Site Request Forgery flaw exists in the WesternDeal WooCommerce Google Sheet Connector plugin that allows an attacker to trigger actions performed by an authenticated user. The vulnerability enables a malicious user to force the victim’s browser to send requests that modify plugin configuration or data in the Google Sheet, potentially corrupting orders or financial records. The weakness corresponds to CWE‑352.

All installations of the WooCommerce Google Sheet Connector plugin for WordPress with version 1.3.20 or earlier are affected. The issue applies to every release from the plugin’s earliest known release through 1.3.20.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of < 1 % suggests that practical exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. To exploit the flaw an attacker would need to convince the victim to visit a crafted URL or embed a malicious form that submits to the plugin’s processing endpoint. Because the plugin lacks an appropriate CSRF token check, the attack can succeed as long as the victim’s session is still active. The overall risk is therefore moderate in terms of impact but low in likelihood of widespread exploitation.