CVE-2018-11633

The WooCommerce Checkout for Digital Goods plugin before version 2.2 contains a cross-site request forgery vulnerability in its settings page function that fails to validate user permissions or implement CSRF protections. An attacker could craft a malicious URL and use social engineering techniques to trick an administrator into clicking it, allowing the attacker to modify the plugin's configuration settings. The vulnerable code in class-woo-checkout-for-digital-goods-admin.php processes requests without verifying nonces or user capabilities, making it possible to alter plugin behavior without proper authorization.

Based on public CVE data (MITRE/NVD).