The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw that allows an attacker to trick an authenticated user into sending authenticated requests to the WordPress site. From the vendor description, the flaw is present in Product Feed PRO for WooCommerce plugin versions up to 13.5.2. An attacker could cause the plugin to perform privileged actions such as changing feed settings, generating feed data or other administrative functions, thereby impacting the confidentiality, integrity, or availability of the site’s e‑commerce data. The weakness corresponds to CWE‑352.

Affected systems are WordPress sites that have Josh Kohlbach Product Feed PRO for WooCommerce installed. The plugin versions impacted are those from the initial release through and including 13.5.2. No other versions are listed as affected.

The vulnerability has a CVSS v3 score of 6.5, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of widespread exploitation at present. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is a web‑based client: a user who is logged into the WordPress admin area visits a malicious web page that automatically submits a forged request to the vulnerable plugin. No additional exploitation conditions are noted in the provided data.