The Gestpay for WooCommerce plugin for WordPress contains a CSRF vulnerability (CWE-352) due to improper nonce validation in the 'ajax_unset_default_card' function. This allows attackers to craft malicious requests that, if executed by an authenticated site administrator, can remove the default status of a stored card token for a user. The vulnerability affects all versions up to 20221130. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. There is no vendor advisory or patch information provided, and no known exploits have been reported.

An attacker can cause an authenticated site administrator to unknowingly remove the default status of a user's card token by exploiting the CSRF vulnerability. This impacts the integrity of the user's payment method configuration but does not affect confidentiality or availability. The impact is limited to the ability to alter the default card token status without authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into the WordPress admin interface. Implementing additional CSRF protections or nonce validation manually may mitigate the risk. Monitor official easynolo or Gestpay plugin channels for updates.