The Alink Tap plugin for WordPress suffers from a CSRF vulnerability due to improper or absent nonce validation on a specific administrative page. This flaw enables attackers to craft forged requests that, when executed by an authenticated administrator, can modify plugin settings and inject malicious web scripts. The vulnerability affects all versions up to and including 1.3.1. The CVSS 3.1 vector indicates the attack requires no privileges but does require user interaction (UI:R), and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker to perform unauthorized changes to plugin settings and inject malicious scripts by leveraging an administrator's authenticated session. This can compromise site integrity and confidentiality. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should exercise caution when interacting with untrusted links and consider disabling or removing the Alink Tap plugin if possible. Implementing additional CSRF protections at the site level may also help mitigate risk.