The Easy PayPal & Stripe Buy Now Button plugin and its Contact Form 7 add-on contain a CSRF vulnerability due to improper nonce validation in the 'wpecpp_stripe_connect_completion' function. This flaw allows attackers to forge requests that can alter plugin settings, including the Stripe connection, if an administrator is tricked into executing the malicious request. The vulnerability affects all versions up to 1.8.3 for the main plugin and up to 2.1 for the add-on. The CVSS 3.1 score is 4.3, indicating medium severity. There is no vendor advisory or patch information available at this time.

An attacker can exploit this vulnerability to modify plugin settings related to the Stripe payment connection by leveraging CSRF attacks. This requires tricking an authenticated site administrator into performing an action such as clicking a crafted link. The impact is limited to integrity of plugin configuration and does not directly affect confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid performing plugin configuration actions while logged in from untrusted sources and consider disabling or limiting access to the affected plugin features. Monitoring vendor channels for updates is recommended.