The vulnerability arises from missing authorization checks that allow an attacker to bypass access control controls. The result is unauthorized access to sensitive functions or data within the Referral Link Tracker plugin. This can lead to data tampering, modification of referral settings, or unauthorized data retrieval, thus compromising the confidentiality and integrity of the site’s tracking mechanisms.

The affected product is the WordPress Referral Link Tracker plugin developed by epiphanyit321. All releases from the earliest version through version 1.1.4 are impacted, meaning any site hosting the plugin at or below 1.1.4 is vulnerable.

With a CVSS score of 4.3 the incident is considered moderate, and the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The plugin is not indexed in the CISA KEV catalog. Based on typical WordPress plugin architecture, the attacker would likely craft HTTP requests to the plugin’s administrative endpoints while authenticated as a user with sufficient privileges, inferring that the attack vector is remote web‑based. The vulnerability does not require the exploitation of other system components beyond the plugin.