The vulnerability is a Cross‑Site Request Forgery flaw in the Product Configurator for WooCommerce plugin that allows an attacker to submit forged requests to the server without proper token validation or nonce checks. By exploiting this issue, a malicious web page could cause a logged‑in user to perform privileged configuration changes or other unintended actions, thereby compromising the integrity of the store and potentially exposing sensitive data.

The affected vendor is mklacroix and the product is Product Configurator for WooCommerce. All versions from the initial release through 1.4.4 are impacted. Any WordPress site that has installed the plugin and has not applied the latest fix is at risk.

The CVSS score of 5.4 indicates moderate severity while the EPSS score of less than 1% shows a very low probability of exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. Based on the nature of CSRF, the likely attack vector is a browser‑based scenario in which an authenticated user visits a malicious page that triggers the forged request. This would allow an attacker to manipulate the plugin’s settings or perform unauthorized actions as that user.