This vulnerability is a CSRF issue in the Extra Product Options Builder for WooCommerce plugin by RedNao, affecting versions up to 1.2.104. It allows attackers to induce authenticated users to perform actions without their consent by exploiting the lack of proper request validation. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low attack complexity and no required privileges but requiring user interaction. No official fix or patch has been announced, and no known active exploitation has been reported.

An attacker could exploit this vulnerability to cause an authenticated user to perform unintended actions within the WooCommerce plugin context. The impact is limited to integrity as per the CVSS vector, with no confidentiality or availability impact reported. Since no known exploits are in the wild, the immediate risk is moderate but should be monitored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible, or limiting plugin usage to trusted environments. Monitor vendor communications for updates on patches or official mitigations.