The WordPress plugin Blacklist Manager – WooCommerce Anti‑Fraud, Blacklist & Checkout Verification, all versions up to 2.3.1, has a vulnerability that enables a Cross Site Request Forgery (CSRF) attack without any authentication. The flaw is classified as CWE‑352, which indicates that a request can be forged and accepted by the server as if it originated from a legitimate user. Because the attack does not require credentials, any visitor who loads a maliciously crafted page could potentially trigger the plugin’s protected actions, but the advisory does not specify which actions can be altered or how they affect the e‑commerce workflow. It is therefore inferred that the vulnerability could be leveraged to modify plugin settings or the blacklist entries, thereby impacting fraud mitigation or checkout behavior.

All WordPress installations that have the YoOhw Studio Blacklist Manager – WooCommerce Anti‑Fraud, Blacklist & Checkout Verification plugin with a version of 2.3.1 or older are impacted. Sites that have not upgraded beyond 2.3.1 are fully susceptible.

The CVSS score of 8.8 marks the flaw as High, indicating a significant risk to the integrity and availability of the e‑commerce platform. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog as of the latest advisory. The likely attack vector is a web‑based exploitation where a forged request is sent to the plugin’s endpoints, bypassing authentication checks. No privileged access is required, so any exposed visitor could serve as a vehicle for the attack.