Woo Commerce Minimum Weight WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Woo Commerce Minimum Weight plugin for WordPress, affecting all versions up to and including 3.0.1. The vulnerability arises from a lack of nonce verification in the settings update handler of edit-weight.php. This flaw allows unauthenticated attackers to alter the minimum order weight setting by deceiving a site administrator into clicking a link or visiting a page controlled by the attacker, which contains a forged POST request.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the minimum order weight setting, potentially leading to incorrect order processing or weight-based shipping calculations.