CVE-2024-0431

CVE-2024-0431 — Gestpay for WooCommerce (WordPress) is a CSRF vulnerability in the ajax_set_default_card handler caused by missing/incorrect nonce validation. It allows unauthenticated attackers to set a user’s default card token via a forged request if a site admin is enticed to perform an actio...

CVE-2024-0433

Gestpay for WooCommerce (WordPress plugin) is vulnerable to Cross-Site Forgery via multiple AJAX endpoints (ajax_unset_default_card in versions up to 20221130; similarly documented in ajax_delete_card and related actions). The issue arises from missing/incorrect nonce validation, allowing unauthe...

CVE-2024-0432

CVE-2024-0432 concerns the Gestpay for WooCommerce plugin for WordPress. The issue is a CSRF vulnerability caused by missing or incorrect nonce validation in the ajax_delete_card function across versions up to 20221130. This enables unauthenticated attackers to delete a user’s default card token ...