Cross-Site Request Forgery in WooCommerce Canada Post Shipping Method

Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Canada Post Shipping Method.This issue affects Canada Post Shipping Method: from n/a through 2.8.3.

• WooCommerce Canada Post Shipping Method: the default status is unaffected, but releases from n/a through and including 2.8.3 are marked affected.
• The CNA change record marks 2.8.4 as unaffected, and Patchstack identifies that release as the patched version.
• The published scope is the WordPress Canada Post Shipping Method plugin. The status of other parallel or unverified release branches is not separately documented and should not be inferred.

WooCommerce Canada Post Shipping Method is a WordPress plugin affected by a Cross-Site Request Forgery (CSRF) flaw, classified as CWE-352. The CNA describes the attacker as unauthenticated, but exploitation requires user interaction such as a privileged user clicking a malicious link, visiting a crafted page, or submitting a form. The victim must have an active authenticated session and sufficient privileges for the targeted action to be processed in that user's context. The public advisory does not identify the affected endpoint, request fields, or the specific implementation check involved. As a result, the exact action that can be forced is not confirmed beyond the general description of an unwanted action performed with the victim's authority.

• Reachability: The issue can be triggered through a network request against a WordPress site using the plugin.
• Authentication: The CNA lists the required privilege as unauthenticated.
• Precondition: User interaction is required; an authenticated user with suitable privileges must visit attacker-controlled content or perform a prompted action.
• Complexity: The normalized record identifies low attack complexity.
• Known exploitation: The authoritative sources consulted do not document a public exploit or a specific exploitation campaign for this issue. That does not prove that exploitation has never occurred outside those sources' visibility.

The flaw can cause a request prepared by an attacker to be processed with the authority of an authenticated user, leading that user to perform an action they did not intend. Under the attack model in the record, scope is unchanged, so the result is expected to remain within the authority of the affected WordPress site. The CNA describes the consequence as forcing higher-privilege users to execute unwanted actions, while the NVD assessment records potentially broader effects across confidentiality, integrity, and availability. The available implementation details do not establish those broader outcomes or identify a specific affected data set or service.

• An attacker may cause a higher-privilege user to perform an unintended action within that user's authenticated session.
• The operational and data consequences depend on the endpoint or function exposed to CSRF; the advisory does not identify a specific operation.
• The normalized record includes an NVD assessment that treats confidentiality, integrity, and availability as potentially affected, while the CNA describes the more specific consequence of forcing unwanted actions with a lower integrity impact assessment.
• The authoritative material reviewed does not confirm data disclosure, service disruption, account changes, or a particular incident.

1. Update to 2.8.4. This is the fixed release explicitly identified by the CNA and Patchstack.
2. Verify after updating that every site in the inventory is running the fixed release, rather than updating only a representative site.
3. If an immediate update is not possible, ask the hosting provider or web developer for help reducing exposure while the update is pending. The sources reviewed do not provide a specific alternative technical mitigation.
4. Enable an appropriate auto-update or patch-management process for the plugin if the organization can test and control the resulting changes.

1. Inventory WordPress sites and identify installations where the Canada Post Shipping Method plugin is installed or active.
2. Compare each installed plugin version with the affected and fixed boundaries in the affected summary; do not assume an unverified branch is safe.
3. Review WordPress audit records and administrative logs for unexpected actions performed in higher-privilege user sessions, especially after users visit untrusted links, pages, or forms. Treat this as precautionary monitoring, not as a confirmed indicator.
4. Check plugin update history and verify that the remediation has been completed across every inventoried site.
5. No specific IOC, endpoint, or log signature is provided by the public sources. The absence of suspicious log activity does not prove that a site is safe.