CVE-2023-52222 is a medium severity (4.3) cross-site request forgery in the WooCommerce WordPress plugin, affecting version 8.2.2 and earlier. The developer fixed it in version 8.3.0. Update the plugin to 8.3.0 or later, and if you cannot update, deactivate it until you can.
What's affected
The NVD record names Automattic and the WooCommerce plugin for WordPress, from the earliest release through 8.2.2. Patchstack lists 8.3.0 as the patched version. Upgrade to 8.3.0 or any later release.
The weakness is CWE-352, cross-site request forgery. The record's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, which gives 4.3 (Medium).
Patchstack lists the required privilege as unauthenticated. The attacker needs no account, but a privileged user has to click a link or visit a crafted page. The effect in the vector is a low availability impact only. Patchstack rates the priority as low.
How to check if you're exposed
Start with the plugin list. On a server with WP-CLI, run this from the site folder:
wp plugin list
wp plugin get woocommerce
The first command shows every installed plugin with its version and status. The second shows the details of this one. If the slug is not found, the plugin is not installed under that folder name.
Without shell access, open Plugins, Installed Plugins in the admin and read the version under the plugin name. On WordPress multisite, check the network plugin list and each site, since a plugin can be active on only some of them.
A version at or below 8.2.2 is in the affected range. An inactive plugin is lower risk than an active one, but it is still on disk, so remove it if it is unused.
What to do now
- Open the Plugins screen, or run the WP-CLI check above, and note the installed version.
- Update WooCommerce to 8.3.0 or later on staging first if you test changes, then on production.
- If the update cannot go out today, deactivate the plugin. A deactivated plugin does not run its code.
- Review recent activity: review recent changes to store settings you did not make.
- Add the plugin to whatever tracks your WordPress inventory, so the next advisory finds it quickly.
Why it matters
Cross-site request forgery works because the browser attaches the visitor's login cookie to any request sent to your site, including one triggered from a page the attacker controls. If a plugin accepts a state changing request without checking a secret token, the request is treated as a deliberate action by the logged in user.
The attack needs a person with the right privileges to be lured into visiting a page or clicking a link, which is why the score is modest. It is still worth closing, because administrators browse the web while logged in to their sites. This one has a low availability effect only. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and the sources I read do not report exploitation in the wild. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan and the Gold directory help you track which components you run and which advisories apply.
Quick check
Is CVE-2023-52222 a serious WooCommerce flaw?
NVD scores it 4.3, medium, and Patchstack rates the priority as low. It needs a privileged user to be tricked, and the effect is limited. Updating to 8.3.0 is still routine hygiene.
Is there a patched version?
Yes. Patchstack lists 8.3.0 as the patched release for versions up to 8.2.2. Check the plugin's own changelog before you upgrade.
Sources
Last reviewed: 19 October 2026.
