This vulnerability is a Cross‑Site Request Forgery flaw (CWE‑352) that permits an attacker to trick a logged‑in WordPress user into executing unintended actions through the affiliate‑toolkit plugin. It is inferred that the attacker requires an authenticated victim session, as CSRF typically exploits logged‑in users. It does not enable remote code execution, but it can lead to unauthorized modifications of site settings or data processed by the plugin.

The affected component is the SERVIT Software Solutions affiliate‑toolkit plugin for WordPress, versions up through 3.7.3. Any WordPress site using these releases should verify the installed plugin version.

The EPSS score is below 1 %, suggesting that exploitation is expected to be uncommon, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that a CSRF attack requires an authenticated victim, typically via an known browsing session or compromised account. The likely attack vector involves an attacker crafting malicious URLs or embedding forms that trigger the plugin to process the request without proper validation. The CVSS score of 5.4 reflects a moderate impact on confidentiality, integrity, and availability.