This vulnerability (CWE-352) in Tyche Softwares' Product Input Fields for WooCommerce plugin allows an attacker to perform Cross-Site Request Forgery attacks. The issue affects versions up to 1.7.0. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation level has been disclosed, and no exploits are currently known.

An attacker could trick authenticated users into submitting unauthorized requests that modify data or perform actions without their consent, potentially leading to limited integrity impact. There is no impact on confidentiality or availability. The vulnerability requires user interaction and can be exploited remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing additional CSRF protections such as verifying nonces or tokens in requests if possible. Monitor official Tyche Softwares communications for updates on patches or mitigations.