Cross-Site Request Forgery Vulnerability in Affiliate Plus Plugin for WordPress

CVE-2025-7690

What is CVE-2025-7690?

The Affiliate Plus plugin for WordPress is susceptible to Cross-Site Request Forgery due to improper nonce validation on the 'affiplus_settings' page. This vulnerability allows unauthenticated attackers to potentially execute unauthorized actions if they can manipulate a site administrator into clicking a malicious link. It is crucial for users to update their plugin to maintain their site's security.

References