The vulnerability is a Cross‑Site Request Forgery flaw in the WordPress Barcode Scanner with Inventory & Order Manager plugin. A malicious site could send a forged request that the plugin processes as though it were sent by an authenticated user, potentially causing unintended changes to inventory or order data. While it does not provide remote code execution, the ability to alter business data carries moderate risk to confidentiality and integrity.

The affected product is the Barcode Scanner with Inventory & Order Manager plugin provided by Dmitry V., CEO of UKR Solution. All releases from the original build through and including version 1.11.0 are vulnerable.

The CVSS score of 4.3 indicates moderate severity, and no EPSS data is available, so the exploitation probability is currently unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker designs a malicious web page that posts a request to the plugin’s endpoints while an authenticated user visits that page; successful exploitation would rely on that user’s valid session and on the plugin’s lack of origin or CSRF token validation as identified in CWE‑352.