This vulnerability is a CSRF issue in the Octolize USPS Shipping for WooCommerce – Live Rates plugin, affecting versions up to 1.9.2. It allows an attacker to induce an authenticated user to execute unwanted actions without their consent. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or official remediation has been disclosed as of the publication date.

An attacker could exploit this vulnerability to perform unauthorized actions on behalf of an authenticated user of the affected plugin. The impact is limited to low integrity modification without affecting confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible. Monitor vendor communications for updates on patches or official mitigations.