A CSRF flaw in the Deliver via Shipos for WooCommerce plugin allows an attacker to craft a request that, when visited by a logged‑in privileged user, triggers the plugin to perform an action without the user’s consent. The vulnerability can be exploited to place orders, change shipment details or otherwise manipulate shipping data, potentially affecting the integrity of e‑commerce operations.

The flaw affects the Deliver via Shipos for WooCommerce plugin provided by Matat Technologies. All releases through version 3.0.2 are vulnerable; newer versions are not impacted.

The CVSS score of 4.3 indicates a medium risk level, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to entice a legitimate user to visit a crafted URL while they are authenticated, making the threat primarily a web‑based CSRF scenario.