CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user's identity prior to authenticating them to the site. This makes it possible for unauthenticated attackers to log in as any user, including administrators, granted they have access to the administrator's email.
Explanation of Vulnerability in Simple Terms
The WordPress & WooCommerce Affiliate Program plugin through version 8.4.1 contains an authentication bypass vulnerability. An attacker can gain unauthorized access to the plugin's functionality without valid credentials. This affects all installations of the plugin up to and including version 8.4.1. Site administrators should update immediately to a version newer than 8.4.1.
What an attacker can do
Bypass authentication and gain unauthorized access to affiliate program functionality without valid credentials.
Potential impact on your site
Attackers can access and manipulate affiliate program data, potentially compromising commissions, user accounts, and site integrity.
Conditions required to exploit
Network access only; no authentication, user interaction, or special configuration required.
Key dates
External resources
Related vulnerabilities
