The Official CleverReach Plugin for WooCommerce contains a CSRF vulnerability (CVE-2025-32241) in versions up to 3.4.6. This vulnerability enables attackers to trick authenticated users into executing unwanted actions via crafted requests without user interaction. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No official patch or mitigation guidance is currently available from the vendor.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause low integrity and low availability impacts by performing unauthorized actions within the affected plugin on behalf of a legitimate user. There is no confidentiality impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying standard CSRF mitigations such as disabling or limiting the plugin functionality, restricting access to trusted users only, or implementing web application firewall (WAF) rules to detect and block suspicious requests related to this plugin.