CVE-2024-0432 in Gestpay for WooCommerce Plugin
Summary
by MITRE • 02/28/2024
The Gestpay for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 20221130. This is due to missing or incorrect nonce validation on the 'ajax_delete_card' function. This makes it possible for unauthenticated attackers to delete the default card token for a user via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 02/10/2025
The vulnerability identified as CVE-2024-0432 affects the Gestpay for WooCommerce plugin, a payment processing solution integrated with the WordPress content management system. This issue represents a critical security flaw that undermines the integrity of user payment token management within e-commerce transactions. The vulnerability specifically targets the plugin's handling of card deletion operations, creating a pathway for unauthorized modifications to customer payment information. The affected versions range from the initial release through the 20221130 iteration, indicating a prolonged period during which this weakness remained unaddressed within the plugin's codebase.
The technical root cause of this vulnerability stems from inadequate input validation mechanisms within the plugin's ajax_delete_card function. This function is designed to handle the removal of saved payment tokens from customer accounts through asynchronous requests. However, the implementation fails to properly validate nonce tokens, which serve as cryptographic one-time values used to verify that a request originates from a legitimate source within the WordPress ecosystem. Without proper nonce validation, the system cannot distinguish between authorized administrative actions and maliciously crafted requests, effectively removing the primary security barrier that protects against CSRF attacks. This flaw aligns with CWE-352, which specifically addresses Cross-Site Request Forgery vulnerabilities where insufficient validation of request origins allows attackers to perform unauthorized actions.
The operational impact of this vulnerability extends beyond simple data modification capabilities, as it directly threatens the security and trustworthiness of payment processing within WooCommerce stores. An unauthenticated attacker who successfully tricks a site administrator into executing a malicious request can delete the default card token associated with a customer account, potentially disrupting payment processing workflows and compromising customer payment information. This attack vector represents a significant risk to both merchants and end users, as it could lead to unauthorized payment processing modifications, customer service disruptions, and potential financial losses. The vulnerability's exploitation requires social engineering to convince an administrator to click on a malicious link, but once successful, it can result in permanent deletion of payment tokens that customers may rely on for future transactions.
Security professionals should recognize this vulnerability as a critical component of the broader ATT&CK framework's privilege escalation and credential access categories, specifically aligning with techniques that involve manipulating web application functionality to gain unauthorized access to user resources. The absence of proper nonce validation creates a persistent threat vector that can be exploited across multiple sessions and user interactions, making it particularly dangerous in environments where administrators frequently interact with web applications. Organizations should prioritize immediate remediation through plugin updates to the latest versions that contain proper nonce validation mechanisms. Additionally, administrators should implement network-level protections such as web application firewalls and monitor for suspicious administrative activities that might indicate exploitation attempts. The vulnerability demonstrates the importance of proper input validation and the critical role that nonce mechanisms play in preventing CSRF attacks within WordPress-based applications, particularly those handling sensitive financial information.