The Purchase Button For Affiliate Link plugin for WordPress suffers from a CSRF vulnerability due to the absence of nonce validation in the form handler located in inc/purchase-btn-options-page.php. This flaw allows attackers to forge requests that modify plugin settings without authentication, relying on social engineering to have an administrator execute the malicious request. The vulnerability affects all versions up to and including 1.0.2. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can modify plugin settings without authentication by tricking a site administrator into clicking a crafted link or performing an action. This could lead to unauthorized changes in the plugin configuration, potentially affecting site behavior related to affiliate links. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links while logged into WordPress and consider restricting access to the plugin settings page. Monitoring for updates from the vendor or plugin author is recommended to apply an official fix once available.