CVE-2024-0432

Summary

CVE-2024-0432 is a Cross-Site Request Forgery vulnerability affecting the Gestpay for WooCommerce plugin for WordPress. Versions up to and including 20221130 are impacted. The issue arises due to inadequate nonce validation on the 'ajax_delete_card' function. Consequently, unauthenticated attackers can manipulate a site administrator into deleting the default card token for a user through a malicious link, putting sensitive financial data at risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.