A Cross‑Site Request Forgery flaw exists in the WooCommerce Cloak Affiliate Links plugin up to version 1.0.35. The vulnerability allows an attacker to craft a request that the plugin will accept as legitimate, potentially enabling the attacker to make changes to affiliate links or other configuration settings without the site owner's permission. The impact is limited to the functionality exposed by the plugin but could affect revenue tracking and site branding.

The issue affects users running the datafeedr WooCommerce Cloak Affiliate Links plugin on WordPress sites, specifically versions up through 1.0.35. Any site that has installed this plugin and has not upgraded is potentially vulnerable.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score is listed as below 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability was not included in CISA's KEV catalog, further implying limited exploitation reports. Because this is a CSRF flaw, successful exploitation typically requires a user (or admin) to visit a malicious site or click a crafted link, meaning that the attack vector is inferred rather than directly documented in the CVE description.