The Affiliate Disclosure Statement WordPress plugin is vulnerable to a Cross‑Site Request Forgery flaw (CWE‑352). An attacker who tricks an authenticated administrator into loading a crafted page can submit a request that injects arbitrary HTML or JavaScript which is stored by the plugin. When other users view the affected page, the injected code runs in their browsers, enabling session hijacking, defacement, or data theft. With a CVSS score of 7.1, the weakness carries high risk to confidentiality, integrity and availability for sites that rely on the plugin.

bnielsen’s Affiliate Disclosure Statement plugin, any installation with a version less than or equal to 0.3. This includes all WordPress sites that have not upgraded past that release.

The EPSS score of less than 1 % suggests that widespread exploitation has not yet been observed, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the CVSS score indicates that a successful CSRF attack could lead to persistent script execution in other visitors’ browsers. The typical attack path involves a malicious site or email that causes a privileged admin to unknowingly submit a forged request; because the plugin lacks a CSRF token, the server stores the malicious payload and serves it to all users.