The Coil Web Monetization plugin for WordPress contains a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation on the coil‑get‑css‑selector parameter in the maybe_restrict_content function. An unauthenticated attacker can forge a request that triggers the CSS selector detection routine when a site administrator clicks a malicious link, allowing the attacker to invoke functionality the admin did not intend to execute. The flaw does not provide direct code execution or data disclosure but enables unauthorized action execution on the site.

Vendors: interledger; Product: Coil Web Monetization WordPress plugin. All versions up to and including 2.0.2 are affected. No further sub‑version detail is supplied.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of less than 1% implies a very low probability of exploitation at this time. The flaw is listed as not in the CISA KEV catalog. Exploitation requires a social engineering attack that convinces an administrator to visit a crafted URL, a typical CSRF scenario. The attack vector is remote via HTTP, and no local privilege escalation is required.