The mklacroix Product Configurator for WooCommerce plugin versions up to 1.4.4 contain a CSRF vulnerability that could allow an attacker to trick authenticated users into executing unintended actions. The vulnerability is network exploitable without privileges and requires user interaction. It results in no confidentiality impact but has limited impact on integrity and availability, reflected by a CVSS 3.1 base score of 5.4. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation of this CSRF vulnerability could allow attackers to cause limited integrity and availability impacts by making authenticated users perform unwanted actions within the affected plugin. There is no impact on confidentiality. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible, or limiting exposure by restricting access to the plugin's administrative functions. Monitor vendor channels for updates.