PT-2025-16620 · Unknown · Integration For Woocommerce/Quickbooks

Nguyen Xuan Chien · Published 2025-04-16 · Updated 2025-04-20 · CVE-2025-39600

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Integration for WooCommerce and QuickBooks versions 1.3.1 and earlier

Description A Cross-Site Request Forgery (CSRF) issue affects the software, allowing unauthorized actions. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the potential for an attacker to perform actions as another user without their knowledge or consent.

Recommendations For versions 1.3.1 and earlier, update to a version later than 1.3.1 to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures, such as token-based validation, to minimize the risk of exploitation. Restrict access to sensitive functionality to minimize the risk of unauthorized actions.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-39600

Affected Products

Integration For Woocommerce/Quickbooks

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-39600 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wp-woocommerce-quickbooks/vulnerability/wordpress-integration-for-woocommerce-and-quickbooks-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1913823741831794707 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/wp-woocommerce-quickbooks/vulnerability/wordpress-integration-for-woocommerce-and-quickbooks-1-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/23094 · Telegram Post