The LWS Affiliation plugin for WordPress is vulnerable to a Cross Site Request Forgery (CSRF) flaw, allowing an attacker to cause a logged‑in user to perform unauthorized actions related to affiliate management. By tricking the user into visiting a crafted URL, the attacker can trigger state‑changing requests that modify affiliate relationships or settings, potentially leading to incorrect payment allocations or data leakage. The flaw stems from the plugin’s lack of proper CSRF protection for its affiliate endpoints (CWE‑352).

The vulnerability affects the LWS Affiliation plugin by Aurélien LWS, versions 2.3.6 and earlier. Users running any WordPress site with this plugin installed are susceptible until the plugin is updated beyond 2.3.6.

The CVSS base score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% reflects a very low current exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Exploitation requires the victim to be authenticated to the target site and to visit a malicious link that submits a forged request to the plugin’s affiliate endpoint. No bypass of authentication or privileged access is required beyond the user’s existing session.