The MicroPayments – Fans Paysite plugin for WordPress suffers from a CSRF flaw caused by missing or improper nonce validation within the adminOptions() routine. This weakness exposes the plugin’s settings to unauthenticated reset by any attacker that can compound a link or button click from a logged‑in administrator. The resulting exposure can alter subscription handling, financial assets, and wallet configurations, potentially disrupting service availability and compromising sensitive content. The flaw maps to CWE‑352, the common class of cross‑site request forgery vulnerabilities.

WordPress installations running the MicroPayments – Fans Paysite plugin from videowhisper, from version 3.2.0 and earlier, are affected. Any site deploying these plugin versions is at risk until the configuration is updated.

With a CVSS score of 4.3 the flaw presents moderate severity. The EPSS score of less than 1% indicates a very low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been commonly leveraged. Attackers can exploit this by luring an administrator into clicking a malicious link that sends a forged request containing the required administrative session cookie, thereby resetting the plugin settings. No specialized resources or elevated privileges are required beyond the targeted administrator’s credentials.