The Amazon affiliate lite Plugin for WordPress contains a CSRF vulnerability due to improper nonce validation in the 'ADAL_settings_page' function. This flaw enables attackers to craft forged requests that, when executed by an authenticated administrator (e.g., via clicking a link), can modify plugin settings without proper authorization. The vulnerability affects all versions up to 1.0.0. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor as of the publication date.

Successful exploitation allows an attacker to update plugin settings without authentication by leveraging a CSRF attack against an administrator. This can lead to unauthorized changes in the plugin configuration, potentially impacting site behavior or security. There is no direct confidentiality impact reported, but integrity and availability impacts are rated low to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links while logged into WordPress and consider implementing additional CSRF protections or disabling the plugin if feasible.