CVE-2024-12454 is a Cross-Site Request Forgery vulnerability in the Affiliate Program Suite — SliceWP Affiliates WordPress plugin (all versions up to 1.1.23). The issue arises from missing or incorrect nonce validation on a function, enabling attackers to forge requests that an authenticated site administrator might unwittingly execute. This can lead to unauthorized actions being performed within the plugin context. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no indication of known exploits in the wild or an available patch at this time.

Successful exploitation could allow an attacker to perform unauthorized actions by tricking a site administrator into clicking a crafted link, potentially leading to limited confidentiality and integrity impacts within the affected plugin's scope. There is no impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests related to the SliceWP Affiliates plugin and consider disabling or restricting the plugin if possible to reduce risk.