The Whatsiplus Scheduled Notification for WooCommerce plugin contains a Cross‑Site Request Forgery flaw caused by the absence of nonce validation on the wsnfw_save_users_settings AJAX action. An attacker who can coerce a logged‑in administrator into clicking a crafted link or submitting a forged form can alter the plugin’s configuration settings without authentication. The vulnerability only affects the integrity of the plugin’s settings and does not provide code execution or data exfiltration.

WordPress sites that run the Whatsiplus Scheduled Notification for WooCommerce plugin version 1.0.1 or earlier. Versions newer than 1.0.1 are not affected because the CSRF protection has been added in later releases.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1 % reflects a low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires a web‑based CSRF attack: the attacker must prompt a legitimate administrator to perform a request while a logged‑in session is active. This typically involves social engineering, such as a phishing link or malicious form. Given the moderate severity and low exploitation probability, the risk remains manageable but should be mitigated promptly to prevent potential configuration misuse.