CVE-2024-9592 describes a CSRF vulnerability in the Easy PayPal Gift Certificate WordPress plugin (up to version 1.2.3). The issue arises from missing or incorrect nonce validation in the 'wpppgc_plugin_options' function, which handles plugin settings updates. An attacker can exploit this by tricking an authenticated site administrator into submitting a crafted request, enabling unauthorized changes to plugin settings and injection of malicious JavaScript. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity.

Successful exploitation allows an attacker to update plugin settings without authentication and inject malicious JavaScript, potentially leading to unauthorized actions within the affected WordPress site. The impact includes partial confidentiality and integrity loss but no availability impact. There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger plugin settings changes. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.