Yotpo Reviews for WooCommerce <= 2.0.4 - Arbitrary Settings Update via CSRF

Vulnerability

The Yotpo Reviews for WooCommerce plugin, versions up to and including 2.0.4, lacks a nonce check when updating its settings. This CSRF vulnerability allows an attacker to make a logged-in administrator unknowingly change the plugin's settings via a crafted request. The affected endpoint does not validate the request origin, relying only on the user's active session.

Exploitation

An attacker needs to craft a malicious link or page that, when visited by an authenticated administrator, triggers a request to the plugin's settings update endpoint. No additional privileges or special network position is required other than normal web access. The admin must be logged into WordPress during the visit. The attacker can then modify arbitrary plugin settings, such as API keys or display options.

Impact

Successful exploitation permits unauthorized modification of the plugin's settings. Depending on the configuration options, this could lead to disruption of functionality (e.g., disabling reviews), data exfiltration if API keys are changed to attacker-controlled endpoints, or further compromise if the plugin integrates with external services. The attack does not directly achieve code execution or privilege escalation, but may indirectly aid such attacks.

Mitigation

As of the available references [1], no fix has been released. The plugin's vendor has not provided a patched version. Users are advised to discontinue use of the plugin or implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint without a valid nonce. The plugin is not listed in the CISA KEV as of the publication date.