The Dotstore Extra Fees Plugin for WooCommerce (up to version 4.3.3) contains a CSRF vulnerability that enables attackers to trick authenticated users into submitting unauthorized requests. This can lead to unintended changes impacting the plugin's fee-related functionality during checkout. The vulnerability is network exploitable without privileges and requires user interaction. It does not compromise confidentiality but can affect integrity and availability of the affected WooCommerce environment.

Successful exploitation could allow attackers to perform unauthorized actions on behalf of authenticated users, potentially disrupting the checkout fee process or causing denial of service conditions. Confidential data is not directly impacted. The high CVSS score reflects the ease of exploitation and potential impact on system integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible, or limiting plugin usage to trusted environments. Monitor vendor channels for updates and apply patches promptly once available.