The vulnerability is a cross‑site request forgery flaw that permits an attacker to embed arbitrary JavaScript in a request to the plugin. The malicious script is returned in the response and executed in the victim’s browser, resulting in reflected cross‑site scripting. This can compromise confidentiality and integrity by allowing attackers to steal session cookies, deface pages, or perform other client‑side malicious actions.

WordPress sites that install the Lora77 WpZon – Amazon Affiliate Plugin version 1.3 or earlier are affected. The plugin is distributed under the Lora77 brand and is active in WordPress installations that do not restrict the plugin’s endpoints to administrators or other authenticated accounts. No operating system or PHP version constraints are specified, so the issue applies to any environment running the vulnerable plugin.

The CVSS score of 7.1 indicates high potential impact, while the EPSS score of less than 1 % denotes a low probability of exploitation at the present time. The vulnerability is not listed in CISA’s KEV catalog. Attackers can remotely exploit the flaw by constructing a malicious HTTP request that the plugin accepts without CSRF checks; the reflected script then executes when any user—authenticated or not—visits the affected page.