Affiliate Plus WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Affiliate Plus WordPress plugin, affecting all versions through 1.3.2. The issue arises from inadequate nonce validation on the 'affiplus_settings' page, allowing unauthenticated attackers to perform unauthorized actions by tricking site administrators into clicking a link.

Impact

Exploitation of this vulnerability could lead to Cross-Site Scripting (XSS) attacks, where an attacker could inject malicious scripts that are executed in the context of the user's browser.