The Coil Web Monetization plugin for WordPress contains a CSRF vulnerability due to improper or missing nonce validation on the coil-get-css-selector parameter within the maybe_restrict_content function. This allows an attacker to craft a malicious request that, if executed by a site administrator (e.g., by clicking a link), triggers the plugin's CSS selector detection functionality without proper authorization. The vulnerability affects all versions up to and including 2.0.2. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, but requiring user interaction and resulting in low impact to integrity.

An attacker can exploit this vulnerability to cause an administrator to unknowingly trigger the plugin's CSS selector detection functionality via a forged request. While this does not directly compromise confidentiality or availability, it may lead to unintended plugin behavior or minor integrity impacts. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should exercise caution when interacting with untrusted links or requests that could trigger plugin functionality. Monitoring vendor channels for updates or official fixes is recommended.