PT-2025-52544 · WordPress · Amazon Affiliate Lite Plugin

Muhammad Afnaan · Published 2025-12-20 · Updated 2025-12-20 · CVE-2025-14734

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Amazon affiliate lite Plugin versions prior to 1.0.1

Description The Amazon affiliate lite Plugin for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation within the ADAL settings page function. This allows attackers to potentially modify plugin settings by deceiving a site administrator into performing an action, such as clicking a malicious link. A successful attack requires the attacker to trick an administrator into performing an action.

Recommendations Update the Amazon affiliate lite Plugin to version 1.0.1 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-14734

Affected Products

Amazon Affiliate Lite Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14734 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8175ff00-e588-46cf-a743-9c4d4717657a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/afiliados-de-amazon-lite/trunk/ADAL-core.php?rev=1952216#L99 · Note
• https://t.me/CVEtracker/40330 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2002248404500353099 · Twitter Post
• https://twitter.com/CVEnew/status/2002466753054453765 · Twitter Post