The vulnerability is a cross‑site request forgery (CWE‑352) flaw in the Stock Manager for WooCommerce plugin. It allows an attacker to forge HTTP requests that are processed as if they came from an authenticated user, potentially enabling unauthorized changes to the WooCommerce store’s inventory or configuration. This can compromise both the integrity of product stock levels and the operational functionality of the e‑commerce site.

All versions of the Stock Manager for WooCommerce plugin released by storeapps prior to 3.6.0 are affected. WordPress sites using any of these plugin releases are vulnerable if a user with shop‑manager or higher privileges is authenticated and visits a maliciously crafted link.

The CVSS v3.1 score of 5.4 indicates a moderate risk level. An Exploit Prediction Scoring System (EPSS) score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires the target user to be logged in or for an attacker to hijack their session cookies. If these conditions are met, an attacker can execute CSRF actions that manipulate inventory data and shop settings.