CVE-2025-49510 describes a CSRF vulnerability in the WPFactory Min Max Step Quantity Limits Manager for WooCommerce plugin affecting versions up to 5.1.0. The vulnerability enables attackers to trick authenticated users into submitting unauthorized requests that could alter plugin settings or behavior. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows an attacker to perform unauthorized actions by exploiting the trust of an authenticated user via CSRF. The impact is limited to integrity with no confidentiality or availability effects. This could lead to unauthorized modification of quantity limit settings in the WooCommerce plugin, potentially disrupting normal e-commerce operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections such as verifying nonce tokens or disabling the plugin if not in use. Monitor official WPFactory communications for updates and apply any official fixes promptly once released.