CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating importing products.
Explanation of Vulnerability in Simple Terms
The Affiliate Toolkit plugin for WordPress fails to properly check user permissions before allowing modifications to affiliate settings and data. A logged-in user with low privileges can alter affiliate configurations, product displays, or commission settings without authorization. This affects versions up to 3.5.4. Site owners should update to a version newer than 3.5.4 to prevent unauthorized changes to affiliate functionality.
What an attacker can do
A logged-in user can modify affiliate settings and product data without proper authorization.
Potential impact on your site
Unauthorized users can alter affiliate links, commissions, or product displays, potentially redirecting traffic or revenue.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (subscriber or contributor level).
Key dates
External resources
Related vulnerabilities
