What the vulnerability does
01Description
The Purchase Button For Affiliate Link plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing nonce validation on the settings page form handler in `inc/purchase-btn-options-page.php`. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
The Purchase Button For Affiliate Link plugin contains a cross-site request forgery (CSRF) vulnerability affecting versions up to 1.0.2. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction and does not expose sensitive data, but can modify site settings or content.
What an attacker can do
03Attacker Capabilities
Trick a site admin into visiting a malicious page that performs unwanted actions on the site without their consent.
Potential impact on your site
04Site Impact
An attacker can modify plugin settings or site content if they trick an admin into clicking a malicious link.
Conditions required to exploit
05Prerequisites
Site admin must visit an attacker-controlled webpage while logged into WordPress.
Key dates
06Disclosure timeline
March 7, 2026
CVE published
April 8, 2026
Record updated
