CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
What the vulnerability does
Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1.
Explanation of Vulnerability in Simple Terms
The Woocommerce Envato Affiliates plugin fails to properly check user permissions before allowing certain actions. A logged-in user with low privileges can modify or delete affiliate data they should not have access to, or disrupt the plugin's availability. The vulnerability affects versions up to 1.2.1.
What an attacker can do
A logged-in user can modify or delete affiliate records and disrupt plugin functionality without proper authorization.
Potential impact on your site
Affiliate data can be corrupted or deleted by unauthorized users, breaking affiliate tracking and payouts.
Conditions required to exploit
Attacker must have a low-privilege account on the WordPress site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
