CVE-2022-47150
Received Received - Intake
Cross-Site Request Forgery in WooCommerce Conversion Tracking

Publication date: 2026-06-11

Last updated on: 2026-06-11

Assigner: Patchstack

Description
Cross-Site request forgery (CSRF) vulnerability in weDevs WooCommerce Conversion Tracking allows Cross Site Request Forgery. This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.10.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-11
Last Modified
2026-06-11
Generated
2026-06-11
AI Q&A
2026-06-11
EPSS Evaluated
N/A
NVD
CVE-2022-47150
EUVD
EUVD-2022-56006
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
we_devs woocommerce_conversion_tracking From 2.0.0 (inc) to 2.0.10 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue found in the WooCommerce Conversion Tracking plugin for WordPress, versions 2.0.10 and below.

It allows an attacker to trick a privileged user into executing unwanted actions by making them interact with a malicious link, page, or form while authenticated.

Essentially, the attacker can force actions on behalf of the user without their consent.

Impact Analysis

The impact of this vulnerability is considered low severity with a CVSS score of 4.3.

If exploited, an attacker can cause a privileged user to perform unintended actions within the WooCommerce Conversion Tracking plugin.

This could lead to unauthorized changes or operations being performed under the user's authentication, potentially affecting the integrity of tracking data or plugin settings.

Detection Guidance

This vulnerability is a Cross-Site Request Forgery (CSRF) issue affecting WooCommerce Conversion Tracking plugin versions 2.0.10 and below. Detection typically involves verifying the plugin version installed on your WordPress system.

You can check the installed plugin version using WordPress CLI commands or by inspecting the plugin files.

  • Run the command: wp plugin list | grep woocommerce-conversion-tracking to see the installed version.
  • Alternatively, check the plugin version in the WordPress admin dashboard under Plugins.

If the version is 2.0.10 or below, your system is vulnerable to this CSRF issue.

Mitigation Strategies

The immediate mitigation step is to update the WooCommerce Conversion Tracking plugin to version 2.0.11 or later, where the vulnerability is patched.

If you use Patchstack, you can enable auto-update for vulnerable plugins to ensure timely patching.

Additionally, educate privileged users to avoid interacting with suspicious links, pages, or forms to reduce the risk of exploitation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-47150. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart