The Gestpay for WooCommerce plugin for WordPress contains a CSRF vulnerability due to improper nonce validation on the 'ajax_set_default_card' function. This allows unauthenticated attackers to manipulate the default card token for a user if they can induce an administrator to perform an action such as clicking a malicious link. The vulnerability affects all versions up to 20221130. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No patch or official remediation has been provided in the input data.

An attacker can cause an administrator to unknowingly set a default card token for a user by exploiting the CSRF vulnerability. This could lead to unauthorized changes in payment settings, potentially impacting the integrity of user payment configurations. There is no indication of confidentiality or availability impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into the affected WordPress site. Implementing additional CSRF protections or nonce validation manually could mitigate the risk. Monitor official vendor channels for updates and patches.