A Cross‑Site Request Forgery vulnerability exists in the Blair Williams ThirstyAffiliates WordPress plugin. The plugin fails to verify an anti‑CSRF token on requests that alter affiliate links, settings, or other management data. This weakness enables an attacker to craft a forged HTTP request that a logged‑in user will unknowingly submit, allowing the attacker to modify affiliate information or plugin configuration using the user’s privileges. Based on the description, it is inferred that the impact is confined to the user’s allowed actions, but if the targeted user holds an administrator role, the attacker may gain broader control over the site’s affiliate management functions.

All WordPress sites running Blair Williams ThirstyAffiliates plugin version 3.11.9 or earlier are affected. The vulnerability applies to every installation of these releases until the plugin is upgraded beyond 3.11.9.

The CVSS score of 5.4 ranks this issue as medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need a vulnerable WordPress site and an authenticated user who could be enticed by phishing, a malicious link, or other social engineering to visit a page that triggers the state‑changing request. Once executed, the attacker can alter affiliate data without user intervention.