CVE-2023-2329: The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code

high Affects woocommerce-google-sheet-connector (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2023-07-17; advisory modified 2026-06-17.

The WooCommerce Google Sheet Connector WordPress plugin before 1.3.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code

Package: woocommerce-google-sheet-connector (WordPress plugin) WordPress
Affected versions: <=1.3.4
Fixed in: no fix recorded
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 0% (32.9th percentile)
Published: 2023-07-17
Source: nvd

References

NVD record woocommerce-google-sheet-connector (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2023-6553 critical The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all ve also from 2023
CVE-2023-0315 high Froxlor vulnerable to Command Injection also from 2023
CVE-2023-41892 critical Craft CMS Remote Code Execution vulnerability also from 2023
CVE-2023-0992 high The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in v also from 2023
CVE-2023-23488 critical The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthentica also from 2023
CVE-2023-6875 critical The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for Wo also from 2023