CVE-2023-5979

The eCommerce Product Catalog Plugin for WordPress before version 3.3.26 contains a Cross-Site Request Forgery vulnerability caused by insufficient nonce verification in the product and category settings functions. An unauthenticated attacker could exploit this flaw to perform unauthorized bulk deletion, reset, or reassignment of products and categories if a site administrator can be deceived into clicking a malicious link. The vulnerability affects all versions prior to 3.3.26.

Based on public CVE data (MITRE/NVD).