CVE-2022-0398

ThirstyAffiliates Affiliate Link Manager <= 3.10.4 - Subscriber+ Arbitrary Affiliate Links Creation

mediumMissing Authorization

5.4

CVSS Score

5.4

CVSS Score

medium

Severity

3.10.5

Patched in

653d

Time to patch

Description

The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and Cross-Site Request Forgery checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=3.10.4

PublishedApril 10, 2022

Last updatedJanuary 22, 2024

Affected pluginthirstyaffiliates

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/7661d648-543e-46c8-a859-fb722a0c3fc2?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database