The Whatsiplus Scheduled Notification for Woocommerce plugin for WordPress is vulnerable to CSRF due to the absence of nonce validation on a specific AJAX action ('wsnfw_save_users_settings'). This flaw allows an attacker to craft a forged request that, when executed by an authenticated administrator (via social engineering), can modify plugin configuration settings without proper authorization. The vulnerability affects all versions up to and including 1.0.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

An attacker can modify the plugin's configuration settings without authentication by exploiting the CSRF vulnerability, potentially altering how scheduled notifications operate. This requires tricking an administrator into performing an action such as clicking a malicious link. The integrity of plugin settings can be compromised, but there is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, administrators should be cautious about clicking unsolicited links and consider disabling or restricting access to the affected AJAX action if possible. Monitoring for updates from the vendor or plugin maintainers is recommended to apply any forthcoming fixes promptly.