The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress contains a CSRF vulnerability due to improper nonce validation in the adminOptions() function. This flaw allows an attacker to forge requests that reset plugin settings by exploiting the trust of an authenticated administrator who performs an action such as clicking a crafted link. The vulnerability affects all versions up to and including 3.2.0 and does not require prior authentication to exploit, but does require user interaction by an admin. The CVSS 3.1 score is 4.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, user interaction needed, and limited impact on integrity only.

An attacker can reset the plugin's settings without authentication by tricking an administrator into performing an action, potentially disrupting the plugin's configuration. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links and consider restricting administrative access or implementing additional CSRF protections at the web server or application level.