CVE-2023-6625: Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-22 · updated 2026-06-17
Weakness: CWE-352

Description

The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack

Affected products

Product Enquiry for WooCommerce: before 3.1 — fixed in 3.1

How to fix

Upgrade to a fixed version: Product Enquiry for WooCommerce 3.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/d483f7ce-cb3f-4fcb-b060-005cec0ea10f/
https://wpscan.com/vulnerability/d483f7ce-cb3f-4fcb-b060-005cec0ea10f/

Get alerted when CVE-2023-6625 or the next vulnerability affects your stack