A CSRF flaw exists in the Affiliates Manager Google reCAPTCHA Integration plugin that lets an attacker submit a forged request containing malicious code that is then saved to the database. When a user later views a page that renders that data, the injected JavaScript executes in the browser session, potentially allowing the attacker to modify page content or deliver further payloads to the victim.

The vulnerability affects the Affiliates Manager Google reCAPTCHA Integration WordPress plugin, version 1.0.6 and earlier. Any WordPress installation using this plugin is potentially exposed.

The CVSS score of 7.1 reflects moderate to high impact with limited exploitation complexity. The EPSS score of less than 1% indicates that the current likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an attacker to craft a CSRF request that the affected plugin can process, which is inferred as needing the victim to be online and to interact with the plugin’s forms or settings page.