A Cross‑Site Request Forgery flaw exists in the Custom WooCommerce Checkout Fields Editor plugin that allows an attacker to force a logged‑in user, typically an administrator, to unknowingly alter checkout fields. The vulnerability stems from a missing anti‑CSRF token, enabling the attacker to construct a request that the site will accept and apply without the user’s explicit consent.

WordPress sites running the themelocation Custom WooCommerce Checkout Fields Editor plugin version 1.3.4 or earlier are susceptible. Any site that has added custom checkout fields via this plugin may be impacted.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would most likely attempt to lure a privileged user to click a crafted link that submits a form to change checkout settings, relying on the site’s lack of a proper CSRF token.