CVE-2023-6292

The Ecwid Ecommerce Shopping Cart plugin before version 6.12.5 contains a cross-site request forgery vulnerability in its settings update functionality. Authenticated administrators who visit a malicious website could have their plugin configuration altered without their knowledge or consent due to the absence of proper CSRF protections. This flaw allows attackers to modify the plugin's settings through crafted requests executed in the context of a logged-in admin session. The vulnerability has been patched in version 6.12.5 and later.

Based on public CVE data (MITRE/NVD).