CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links.
Explanation of Vulnerability in Simple Terms
The Cloak Affiliate Links for WooCommerce plugin through version 1.0.33 does not properly restrict access to sensitive functionality. An attacker without authentication can modify affiliate link settings and redirect traffic, potentially hijacking commissions or injecting malicious URLs. No user interaction is required. Update to a version newer than 1.0.33.
What an attacker can do
Modify affiliate link settings and redirect traffic without authentication.
Potential impact on your site
Affiliate commissions could be redirected to attacker accounts, or malicious URLs injected into affiliate links.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
