CVE-2025-47633: Awin WooCommerce CSRF Vulnerability

CVE-2025-47633 Overview

CVE-2025-47633 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Awin – Advertiser Tracking for WooCommerce WordPress plugin. The flaw exists in all versions through 2.0.0 and enables attackers to trigger product feed regeneration on a target site by tricking an authenticated administrator into visiting a malicious page. Successful exploitation requires user interaction but no authentication on the attacker side. The vulnerability carries a CVSS 3.1 score of 8.8 with high impact across confidentiality, integrity, and availability.

Critical Impact
An attacker can force authenticated WooCommerce administrators to perform unintended state-changing actions, leading to unauthorized product feed regeneration and potential disruption of advertiser tracking operations.

Affected Products

Awin – Advertiser Tracking for WooCommerce plugin versions up to and including 2.0.0
WordPress sites running the awin-advertiser-tracking plugin
WooCommerce stores integrated with Awin affiliate tracking

Discovery Timeline

2025-05-07 - CVE-2025-47633 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47633

Vulnerability Analysis

The vulnerability stems from missing or improper CSRF protection in the Awin – Advertiser Tracking for WooCommerce plugin. The plugin exposes a product feed regeneration action that does not validate the origin of the request through a properly scoped WordPress nonce or equivalent anti-CSRF token. Authenticated administrators visiting an attacker-controlled page can have their browser issue forged requests to the vulnerable endpoint, which the plugin processes using the victim's session.

The issue is classified under CWE-352 (Cross-Site Request Forgery). Although the immediate documented impact is product feed regeneration, the CVSS vector reflects high confidentiality, integrity, and availability impacts because the abused administrative action can disrupt store operations and influence tracking data integrity.

Root Cause

The root cause is the absence of effective CSRF validation on a privileged plugin action. WordPress provides the wp_nonce_field() and check_admin_referer() APIs for exactly this purpose, but the affected handler in versions through 2.0.0 does not enforce these checks before performing the feed regeneration operation.

Attack Vector

Exploitation proceeds over the network and requires user interaction. An attacker hosts a page containing a hidden form or image tag that auto-submits a crafted request to the vulnerable plugin endpoint on the target WordPress site. When an authenticated administrator loads the malicious page in the same browser session, the request is executed under the administrator's privileges, triggering product feed regeneration without consent.

No verified proof-of-concept exploit code is publicly available. See the Patchstack WordPress Plugin Vulnerability advisory for the technical disclosure.

Detection Methods for CVE-2025-47633

Indicators of Compromise

Unexpected product feed regeneration events recorded in WordPress or plugin logs without corresponding administrator actions
HTTP POST or GET requests to Awin plugin endpoints carrying an HTTP Referer header pointing to external or unknown domains
Spikes in resource consumption on the WooCommerce server correlating with unscheduled feed builds
Authenticated admin sessions issuing plugin requests immediately after browsing untrusted sites

Detection Strategies

Audit web server access logs for requests targeting awin-advertiser-tracking admin endpoints with off-site referers
Enable WordPress audit logging to capture plugin-initiated actions, the requesting user, and the source IP
Correlate WooCommerce feed regeneration timestamps with administrator activity windows to flag anomalies

Monitoring Recommendations

Monitor administrator account behavior for state-changing requests that lack a valid _wpnonce parameter
Alert on outbound links in administrator email or messaging traffic that resolve to the WordPress admin URL
Track plugin version inventory across managed WordPress sites to identify hosts still running version 2.0.0 or earlier

How to Mitigate CVE-2025-47633

Immediate Actions Required

Identify all WordPress sites running the Awin – Advertiser Tracking for WooCommerce plugin and confirm the installed version
Update the plugin to a version newer than 2.0.0 as soon as a patched release is published by the vendor
Restrict administrator browsing habits and require a dedicated browser profile for WordPress administration
Review WooCommerce and plugin logs for evidence of unauthorized feed regeneration activity

Patch Information

At the time of NVD publication, the advisory indicates the vulnerability affects all versions through 2.0.0. Administrators should consult the Patchstack advisory and the WordPress plugin repository for the latest patched release and apply it without delay.

Workarounds

Deactivate and remove the Awin – Advertiser Tracking for WooCommerce plugin until a fixed version is installed
Deploy a Web Application Firewall (WAF) rule that requires a valid same-origin Referer or Origin header on plugin admin endpoints
Enforce SameSite=Lax or Strict cookie attributes on WordPress session cookies to limit cross-site request execution
Limit administrative access to trusted networks using IP allowlists at the web server or WAF layer

bash

# Example nginx rule restricting admin-ajax and plugin endpoints to same-origin requests
location ~* /wp-admin/(admin-ajax\.php|admin-post\.php) {
    if ($http_referer !~* ^https?://your-site\.example/) {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}