CVE-2019-20891: 
PHP vulnerability analysis and mitigation

WooCommerce before version 3.6.5 contains a cross-site request forgery (CSRF) vulnerability that leads to stored cross-site scripting (XSS) when handling CSV imports of products. The vulnerability specifically affects the file includes/admin/importers/class-wc-product-csv-importer-controller.php (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 base score is 6.8 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:P/I:P/A:P). The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD).

A successful exploitation of this vulnerability could allow an attacker to execute arbitrary code through stored XSS after performing a CSRF attack. This could potentially lead to unauthorized access, data manipulation, and compromise of user accounts with high privileges (NVD).

The vulnerability requires user interaction (UI:R in CVSS score) but no privileges (PR:N) to exploit. It can be accessed over the network (AV:N) with low attack complexity (AC:L) (NVD).

Users should upgrade to WooCommerce version 3.6.5 or later to address this vulnerability. The fix has been implemented in this version to prevent CSRF attacks during CSV product imports (NVD).