CVE-2023-22689

The Auto Affiliate Links plugin for WordPress through version 6.3.0.1 suffers from a cross-site request forgery vulnerability in the aalDeleteLink() function caused by inadequate nonce verification. An attacker could craft a malicious request to delete links if an authenticated administrator is tricked into clicking a link, since the function lacks proper CSRF protections. This flaw requires administrative interaction but allows unauthorized link deletion on affected sites.

Based on public CVE data (MITRE/NVD).