CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'export_all_data' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive affiliate data, including personally identifiable information (PII).
Explanation of Vulnerability in Simple Terms
The WC Affiliate plugin for WooCommerce contains an authorization flaw that allows authenticated users with low privileges to access sensitive affiliate data they should not see. An attacker with a basic user account can read confidential information about other affiliates' commissions, referrals, or account details. This affects all versions up to 2.5.3. Site owners should update immediately when a patch becomes available.
What an attacker can do
Read other users' affiliate data, commissions, and referral information without permission.
Potential impact on your site
Affiliate program data and earnings information is exposed to any logged-in user, compromising privacy and trust.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., customer or subscriber role).
Key dates
External resources
