The Associados Amazon Plugin contains a missing or incorrect nonce validation in the brzon_admin_panel() function, allowing an attacker to perform Cross‑Site Request Forgery. An unauthenticated user can trick a site administrator into clicking a crafted link, leading to the automatic update of plugin settings and the injection of malicious scripts stored in the site database. The resulting stored cross‑site scripting can execute inside the browser of any user who visits the affected site. This weakness is classified as CWE‑352 and results in a moderate severity vulnerability with potential for broad compromise once a malicious script runs in the admin context.

The vulnerability affects the Revokee Associados Amazon Plugin for WordPress, all releases up to and including version 0.8. No specific WordPress core versions are listed, but the plugin must be installed on any WordPress site to be impacted.

The vulnerability carries a CVSS score of 6.1 and an EPSS score of less than 1 %, indicating a relatively low likelihood of exploitation under normal circumstances. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an admin user is logged in and falls for a social‑engineering prompt, making it easier for attackers to acquire an authenticated session. Although the risk is moderate, the exploitability is low, and only active, active administrators are the primary attack target.