The Woo Commerce Minimum Weight WordPress plugin suffers from a CSRF vulnerability due to the absence of nonce verification on its settings update handler (edit-weight.php). This flaw enables attackers to craft malicious POST requests that, when executed by an authenticated administrator, can alter the minimum order weight setting without proper authorization. The vulnerability affects all versions up to 3.0.1 and has a CVSS 3.1 base score of 4.3, reflecting a medium severity impact primarily on integrity. No vendor-provided patch or official remediation instructions are currently documented.

An attacker can cause an authenticated site administrator to unknowingly modify the minimum order weight setting of the Woo Commerce Minimum Weight plugin by exploiting the CSRF vulnerability. This impacts the integrity of the plugin's configuration but does not affect confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when clicking links or visiting untrusted sites while logged into WordPress with administrative privileges. Implementing manual nonce verification or other CSRF protections in the plugin code may mitigate the risk if feasible.