CVE-2026-25024: 
WordPress vulnerability analysis and mitigation

CVE-2026-25024 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThirstyAffiliates WordPress plugin developed by Blair Williams. It affects all versions through 3.11.9 and was reported on January 3, 2026, by researcher Trương Hữu Phúc (truonghuuphuc), with public disclosure on February 2–3, 2026. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium), though Feedly categorizes it as HIGH severity (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from insufficient or absent CSRF token validation in the ThirstyAffiliates plugin's request handling. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (e.g., an administrator), triggers unauthorized state-changing actions within the plugin on behalf of that user. Exploitation requires no privileges from the attacker but does require user interaction — specifically, a privileged user must be tricked into visiting a crafted page or clicking a malicious link (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users to execute unwanted actions within the ThirstyAffiliates plugin without their knowledge or consent. The primary impacts are to integrity (low) and availability (low), with no direct confidentiality impact. This could result in unauthorized modification of affiliate link configurations, plugin settings, or other plugin-managed data, potentially disrupting affiliate marketing operations on affected WordPress sites (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the ThirstyAffiliates plugin at version 3.11.9 or earlier using tools like WPScan or Shodan, or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Construct an HTML page or form that automatically submits a forged HTTP request to a vulnerable ThirstyAffiliates plugin endpoint (e.g., an admin action URL), embedding the desired malicious parameters.
3. Deliver payload: Trick an authenticated WordPress administrator or privileged user into visiting the crafted page via phishing email, malicious link, or injected content on another site.
4. Trigger unauthorized action: When the victim's browser loads the page, it automatically sends the forged request with the victim's session credentials, causing the plugin to execute the attacker-specified action (e.g., modifying affiliate links or plugin settings) without the user's knowledge (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to ThirstyAffiliates plugin admin endpoints (e.g., wp-admin/admin-ajax.php or plugin-specific action URLs) from unusual referrer origins or with missing/invalid nonce values.
• Application: Unexplained changes to affiliate link configurations, redirect targets, or plugin settings within the ThirstyAffiliates dashboard.
• Network: HTTP requests to WordPress admin endpoints originating from external or unexpected referrer domains, particularly with auto-submitted form data.

The vulnerability is patched in ThirstyAffiliates version 3.11.10. Site administrators should update the plugin to version 3.11.10 or later immediately. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin panel to trusted IP addresses. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and responsibly disclosed by researcher Trương Hữu Phúc (truonghuuphuc) and assigned a low priority by Patchstack, which noted it is unlikely to be exploited due to its limited impact. No significant broader media coverage or notable community discussion has been identified beyond standard vulnerability database entries (Patchstack).