The WooCommerce Report plugin for WordPress, REPORTiT by ithemelandco, suffers from a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation in its settings update feature. This flaw enables unauthenticated attackers to craft malicious requests that, if executed by an administrator, can update arbitrary plugin options and potentially escalate privileges. The vulnerability affects all versions up to 1.5.1. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, but user interaction needed, and impacts confidentiality, integrity, and availability. No patch or official remediation guidance is currently available.

Successful exploitation allows an attacker to perform unauthorized changes to plugin settings by tricking an administrator into submitting a crafted request. This can lead to privilege escalation and compromise of the affected WordPress site’s confidentiality, integrity, and availability. The vulnerability does not require prior authentication but does require user interaction (administrator clicking a malicious link). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from ithemelandco regarding a security patch is recommended.