The Woo Commerce Minimum Weight plugin for WordPress suffers from a CSRF vulnerability due to the absence of nonce verification on the settings update handler in edit-weight.php. This flaw enables attackers to perform unauthorized changes to the minimum order weight configuration by convincing an administrator to execute a crafted POST request. The vulnerability affects all versions up to and including 3.0.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity level with network attack vector, low attack complexity, no privileges required, and user interaction needed. No official fix or patch has been documented as of the publication date.

An attacker can modify the minimum order weight setting of the Woo Commerce Minimum Weight plugin without authentication by exploiting the CSRF vulnerability. This could lead to unintended changes in e-commerce order restrictions, potentially disrupting business operations or causing confusion. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious when clicking links or visiting untrusted sites while logged into WordPress with administrative privileges. Implementing additional CSRF protections or using security plugins that enforce nonce verification may help mitigate the risk.