CVE-2023-52148 MEDIUM

CVE-2023-52148: WordPress Affiliates Manager Plugin <= 2.9.30 is vulnerable to Sensitive Data Exposure

Vendor Wp.insider, Wpaffiliatemgr
Product Affiliates Manager
Weakness CWE-200 · Info exposure
Published January 5, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.30.

Explanation of Vulnerability in Simple Terms

02Summary

Affiliates Manager through version 2.9.30 exposes sensitive information without proper access controls. An unauthenticated attacker can read data that should be restricted, such as affiliate details or configuration information. The vulnerability requires no special setup and can be exploited remotely over the network. Site administrators should update to a version newer than 2.9.30 immediately.

What an attacker can do

03Attacker Capabilities

Read sensitive affiliate or configuration data without authentication.

Potential impact on your site

04Site Impact

Affiliate data, earnings, or site configuration may be exposed to the public.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

January 5, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-5032 W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header CVE-2026-7636 Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpoint CVE-2026-3504 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint CVE-2026-4126 Table Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute CVE-2026-7542 Slider Revolution <= 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure