The Gestpay for WooCommerce plugin for WordPress contains a CSRF vulnerability (CWE-352) in the 'ajax_delete_card' function due to missing or incorrect nonce validation. This flaw allows an attacker to craft a forged request that, when executed by a site administrator (via UI interaction), can delete the default card token associated with a user. The vulnerability affects all versions up to and including 20221130. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. There is no vendor advisory or patch information provided, and no known exploits have been reported.

An attacker can cause denial of availability of a user's default card token by tricking a site administrator into executing a forged request. This could disrupt payment processes relying on the stored card token. There is no direct confidentiality or integrity impact reported. The attack requires user interaction from an administrator and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or content. Monitoring for updates from the vendor easynolo or the WordPress plugin repository is recommended to apply any forthcoming patches promptly.