CVE-2026-1073

Name of the Vulnerable Software and Affected Versions Purchase Button For Affiliate Link plugin for WordPress versions prior to 1.0.3

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF). This is because of a lack of nonce validation on the settings page form handler located in inc/purchase-btn-options-page.php. An unauthenticated attacker could potentially modify plugin settings by forging a request, provided they can trick a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Purchase Button For Affiliate Link plugin to version 1.0.3 or later.