A Cross Site Request Forgery vulnerability in nopCommerce 4.90.0 allows unauthenticated attackers to perform unauthorized actions via the Schedule Tasks module.

This vulnerability is a Cross Site Request Forgery (CSRF) flaw residing in the Schedule Tasks functionality, which can be triggered by an unauthenticated attacker to manipulate system tasks.

The exploitation of this vulnerability could lead to a complete compromise of the application integrity and availability, as indicated by the high CVSS score of 8.8. By forcing administrative actions via CSRF, an attacker may disrupt core business processes, modify system configurations, or execute unauthorized background tasks that could result in significant operational downtime or data manipulation.

Immediate Action: Monitor the vendor advisory page for the release of an official security patch and apply it immediately upon availability.

Proactive Monitoring: Review application access logs for suspicious requests targeting the Schedule Tasks endpoint or unusual task execution patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with CSRF protection rules enabled to filter malicious requests before they reach the application backend.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this vulnerability and its potential for total impact on application operations, administrators must prioritize identifying if their deployment is running version 4.90.0. While waiting for a formal vendor patch, ensure that all administrative interfaces are restricted to trusted networks and that layered defenses, such as WAF rules, are active to block potential CSRF triggers.