The WPExperts APIExperts Square for WooCommerce plugin contains a Cross‑Site Request Forgery vulnerability that lets an attacker force an authenticated user to submit unintended requests against the WooCommerce store. This could enable unauthorized changes, such as modifying order details or altering site configuration, without the user’s knowledge.

WordPress sites using the APIExperts Square for WooCommerce plugin from WPExperts, in any version up to and including 4.7.5. All subsequent releases, starting with 4.7.6, are not affected. Site administrators should confirm the installed plugin version and plan an upgrade if necessary.

The CVSS v3.1 score is 5.4, indicating a moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented mass exploitation. The attack vector is web‑based and requires the victim to be authenticated to the store’s administration area; an attacker can craft a link or form that submits a request to a protected endpoint executed in the victim’s browser.