The Purchase Button For Affiliate Link plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the settings page form handler. This flaw allows an unauthenticated attacker to forge a request that modifies the plugin’s configuration when an administrator inadvertently submits the form. The primary impact is a loss of integrity for the plugin’s settings, potentially altering its behavior without the site owner’s consent.

The vulnerability affects themepul’s Purchase Button For Affiliate Link plugin in all releases up to and including version 1.0.2. Administrators using any of these versions on a WordPress installation are at risk unless they upgrade to a fixed version.

The CVSS score of 4.3 indicates a moderate severity, but the EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild. The issue is not listed in the KEV catalog. Exploitation requires the attacker to entice a logged‑in administrator to click a crafted link or submit a form, making physical and social engineering constraints a key factor. While the vulnerability is technically possible to exploit, realistic attack scenarios are limited.