The vulnerability occurs in the WC Vendors WordPress plugin for versions prior to 2.7.2.1, where certain front‑end actions that update the shipment status of orders lack proper CSRF protection. An attacker who can influence a logged‑in vendor user—such as by luring them to a crafted URL or embedding malicious content—can trick the vendor into submitting a request that changes an order’s status to a value chosen by the attacker. The effect is a manipulation of the vendor’s order workflow, potentially causing incorrect shipping information, customer dissatisfaction, or financial loss. This flaw is a classic CSRF weakness (CWE‑352).

This flaw affects installations of the WC Vendors WordPress plugin for any application version less than 2.7.2.1. Users should verify their plugin version and apply the 2.7.2.1 update or later. All WooCommerce‑based sites using WC Vendors that have not applied the recommended patch are impacted.

The vulnerability is exploitable by attackers who can persuade an authenticated vendor to visit a crafted link or load a page that contains a malicious request. Because the plugin exposes state‑changing operations without token validation, the attack requires only a logged‑in session; no elevated privileges are needed beyond vendor rights. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, suggesting limited commercial exploitation to date. Nevertheless, the impact on individual vendors could be significant, and the lack of mitigations makes the attack straightforward once the target vendor is identified. Applying a patch or temporarily disabling the vulnerable functionality mitigates the risk.