Cross-Site Request Forgery Vulnerability in Amazon Affiliate Lite Plugin for WordPress
CVE-2025-14734
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 December 2025
What is CVE-2025-14734?
The Amazon Affiliate Lite Plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit missing nonce validation in the 'ADAL_settings_page' function. This security flaw can enable attackers to perform unauthorized actions, such as updating plugin settings, by tricking a site administrator into engaging with a malicious link. All versions up to and including 1.0.0 are impacted, making it crucial for website owners to implement security measures promptly.
Affected Version(s)
Amazon affiliate lite Plugin * <= 1.0.0