CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
What the vulnerability does
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating product lists.
Explanation of Vulnerability in Simple Terms
The Affiliate Toolkit plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to read, modify, or delete data they should not have access to. An attacker with a basic user account can exploit this to access sensitive affiliate or product information. The vulnerability affects all versions up to 3.5.4.
What an attacker can do
Read, modify, or delete affiliate data and product information without proper authorization.
Potential impact on your site
Affiliate data, product listings, and sensitive configuration may be exposed or altered by low-privilege users.
Conditions required to exploit
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
