Conversios All-in-One Google Analytics and Product Feed Manager for WooCommerce Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Conversios All-in-One Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin, affecting versions through 5.2.3. This vulnerability allows attackers to manipulate plugin settings by exploiting the absence of proper CSRF protections.

Impact

Exploitation could enable attackers to force users with higher privileges to make unintended changes to the plugin settings, potentially leading to broader security issues.

Remediation

Users of the affected plugin should update to version 5.2.4 or later. Patchstack users can enable auto-update for vulnerable plugins.