The Coil Web Monetization plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 2.0.2. The issue arises from missing or incorrect nonce validation on the coil-get-css-selector parameter in the maybe_restrict_content function. This flaw allows unauthenticated attackers to trigger CSS selector detection functionality if they can trick a site administrator into performing an action such as clicking a malicious link.