A Cross-Site Request Forgery vulnerability in the Product Feed PRO for WooCommerce plugin allows unauthenticated attackers to perform unauthorized administrative actions by tricking a site administrator.

The vulnerability stems from missing or incorrect nonce validation on critical AJAX functions, specifically ajax_migrate_to_custom_post_type, ajax_adt_clear_custom_attributes_product_meta_keys, ajax_update_file_url_to_lower_case, ajax_use_legacy_filters_and_rules, and ajax_fix_duplicate_feed. These flaws allow an unauthenticated attacker to manipulate plugin settings or delete feed posts if they can successfully trick an authenticated administrator into clicking a malicious link.

The exploitation of this vulnerability could lead to unauthorized administrative modifications, including the deletion of feed data and the alteration of plugin configurations. With a CVSS score of 8.8, the potential for high impact on data integrity and availability is significant, posing a serious risk to e-commerce operations that rely on accurate product feeds for revenue generation.

Immediate Action: Administrators should immediately audit their WordPress plugin installations and update the Product Feed PRO for WooCommerce plugin to the latest available version if a patch has been released. If no patch is currently available, the plugin should be temporarily deactivated to prevent potential exploitation.

Proactive Monitoring: Monitor server access logs for unusual administrative requests or unexpected changes to plugin settings and feed configurations.

Compensating Controls: Deploy a Web Application Firewall to filter suspicious incoming requests that lack proper validation tokens, providing a layer of protection against forged requests.

Public Exploit Available: Unknown.

Given the high CVSS score, this vulnerability represents a significant risk to the integrity of the affected WooCommerce environment. Organizations should prioritize updating the plugin immediately upon the availability of a security release and ensure that administrative users are trained to avoid clicking suspicious links while logged into the WordPress dashboard.