CVE-2021-4392

The eCommerce Product Catalog Plugin for WordPress contains a cross-site request forgery vulnerability affecting versions 2.9.43 and earlier due to insufficient nonce checks in the implecode_save_products_meta() function. An unauthenticated attacker could exploit this flaw to modify product metadata by crafting a malicious request and deceiving an administrator into activating it through a link click or similar action. The vulnerability was patched in version 2.9.44.

Based on public CVE data (MITRE/NVD).