The Affiliate Plus plugin for WordPress contains a Cross‑Site Request Forgery vulnerability caused by missing or incorrect nonce validation on its settings page. This flaw permits an unauthenticated attacker to masquerade as an administrator by luring the admin to click a malicious link or submit a crafted request, thereby executing actions that the admin is authorized to perform. The impact manifests as unauthorized configuration changes and could expose the site to further exploitation, such as stored cross‑site scripting, although the vulnerability itself does not directly inject scripts.

WordPress sites running the Affiliate Plus plugin by mindnl, versions 1.3.2 or earlier, are affected. The vulnerability impacts all installations that include the affiplus_settings page without proper nonce checks.

With a CVSS score of 6.1 the flaw is considered medium severity. The EPSS score of < 1% indicates that documented exploitation is unlikely, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to trick an administrator into following a malicious link or submitting a forged request, making the attack vector largely social‑engineering based rather than automated.