The CVE describes a Cross‑Site Request Forgery (CSRF) vulnerability in the Dotstore Extra Fees Plugin for WooCommerce. The flaw allows an attacker to send a forged request that the plugin processes as if it originated from a legitimate authenticated user, enabling unauthorized actions under the user’s context.

Any WordPress site that runs the Dotstore Extra Fees Plugin for WooCommerce up through version 4.3.3 is affected. No other vendors or product versions are listed as impacted. Sites using later versions are not known to have this issue.

The CVSS score of 7.1 reflects a high severity, while the EPSS score of under 1% indicates low exploit probability. The flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. Based on the description, it is inferred that the attacker must target an authenticated user's session, and the likely attack vector is a crafted request sent from a malicious site to a victim site where the user is logged in.