CVE-2025-24647 identifies a CSRF vulnerability in the datafeedr WooCommerce Cloak Affiliate Links plugin (versions <= 1.0.35). The vulnerability enables attackers to induce authenticated users to execute unwanted actions without their consent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No patch or vendor advisory is available at this time.

Successful exploitation could lead to low integrity and availability impacts by causing users to unknowingly perform actions within the affected plugin. There is no confidentiality impact. The vulnerability requires user interaction and can be exploited remotely without privileges. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted links and consider disabling or limiting use of the affected plugin. Monitor official vendor channels for updates and patches.