This vulnerability (CVE-2026-57758) is an unauthenticated Cross-Site Request Forgery (CWE-352) in the BeRocket Permalink Manager for WooCommerce plugin, affecting versions up to 1.0.8.2. It allows attackers to trick users into submitting unwanted actions without their consent, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed as of the published date.

The vulnerability allows unauthenticated attackers to perform CSRF attacks, which can lead to unauthorized actions being executed in the context of a victim user. The CVSS score indicates limited but non-negligible impacts on confidentiality, integrity, and availability. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing manual CSRF protections or disabling the affected plugin if feasible. Monitor vendor channels for updates and patches.