The vulnerability resides in the Woo Commerce Minimum Weight plugin’s settings update handler, where a nonce check is omitted. The resulting CSRF flaw allows an unauthenticated attacker to force a logged‑in site administrator to submit a forged POST request that alters the minimum order weight configuration. This change can affect shipping calculations or order eligibility, potentially disrupting e‑commerce operations. The flaw is classified as a CSRF (CWE‑352) and carries a CVSS score of 4.3, indicating a moderate risk level.

All installations of the Woo Commerce Minimum Weight plugin for WordPress, version 3.0.1 and earlier, developed by hemant29.

The CVSS score of 4.3 reflects a moderate severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog. The exploit requires only a delivered forged POST request to the settings page; the attacker does not need to compromise the site beforehand. The attack vector is likely a malicious link or page that an administrator unknowingly visits, prompting the automatic form submission. Once the administrator clicks the link, the unverified change is applied with the admin’s privileges.