The Petje.af plugin for WordPress is vulnerable to a Cross‑Site Request Forgery flaw that allows an attacker to trigger the 'petjeaf_disconnect' AJAX action without any nonce verification. This action performs critical operations such as revoking OAuth2 tokens, deleting user meta, and permanently removing WordPress user accounts that have the 'petjeaf_member' role. Consequently, an attacker who can convince an authenticated user to load a malicious page can cause that user to lose their Petje.af member account and associated data. The weakness is classified as CWE‑352.

All versions of Petje.af up to and including 2.1.8 are impacted. The affected product is the Petje.af WordPress plugin, as listed by its CNA vendor "petjeaf". Users running any of these versions should verify whether they are within this version range.

The CVSS score is 4.3, indicating a medium severity level. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that known exploitation cases are limited or not yet reported. Attackers would need the victim to click a crafted link or visit a malicious site, which provides a reasonably low barrier to exploitation for socially engineered users. The risk is mitigated only by preventing the CSRF request from being accepted, which requires a patch or configuration change from the vendor.