CVE-2026-25024

Cross-Site Request Forgery (CSRF) vulnerability exists in the ThirstyAffiliates plugin for WordPress, developed by Blair Williams. The issue affects plugin versions from n/a through 3.11.9 and stems from a lack of proper CSRF token validation during sensitive operations [1].

An attacker can exploit this by crafting a malicious link or form and tricking a privileged user (such as an administrator) into clicking it while authenticated to the WordPress site. No direct authentication bypass is required; instead, the attacker relies on the victim's existing session to forge requests [1].

Successful exploitation could allow an attacker to force the victim to execute unwanted actions within the plugin's administrative functions under the victim's current session, potentially leading to unauthorized changes in affiliate links or settings [1].

The plugin vendor has released version 3.11.10 to address this vulnerability. Users are advised to update to this latest version. For those unable to update immediately, consulting with hosting providers or web developers is recommended [1].