This vulnerability involves a CSRF issue in the ThirstyAffiliates plugin by Blair Williams, affecting all versions up to 3.11.9. The flaw allows an attacker to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity and availability impacts. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. No patch or vendor advisory is currently provided, and no exploits are known.

Successful exploitation could result in limited integrity and availability impacts, such as unauthorized changes or disruptions caused by forged requests executed in the context of an authenticated user. Confidentiality is not affected. The medium CVSS score reflects these limited but tangible impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying request origins or using anti-CSRF tokens if possible. Monitor vendor channels for updates and apply patches promptly once released.