An unauthenticated CSRF vulnerability exists in FunnelKit Payment Gateway for Stripe WooCommerce versions <= 1.14.0.3. This vulnerability allows attackers to trick authenticated users into submitting unwanted requests, leading to unauthorized actions with high integrity impact but no confidentiality or availability impact. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

The vulnerability can lead to unauthorized modification of data or settings within the affected plugin due to forged requests initiated by an attacker without authentication. There is no impact on confidentiality or availability, but the integrity of the system can be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should consider applying compensating controls such as disabling the affected plugin or restricting access to trusted users only. Monitor vendor communications for updates on remediation.