The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function in all versions up to, and including, 6.4.3. This makes it possible for authenticated attackers, with subscriber access or higher, to add arbitrary links to posts.
References
Configurations
History
03 Apr 2025, 12:57
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
| First Time |
Flamescorpion
Flamescorpion auto Affiliate Links |
|
| CWE | CWE-862 | |
| CPE | cpe:2.3:a:flamescorpion:auto_affiliate_links:*:*:*:*:*:wordpress:*:* | |
| References | () https://plugins.trac.wordpress.org/browser/wp-auto-affiliate-links/trunk/aal_ajax.php#L79 - Product | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/09e5aa34-ab28-4349-ac5f-6a0479e641e5?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3044067%40wp-auto-affiliate-links&new=3044067%40wp-auto-affiliate-links&sfp_email=&sfph_mail= - Patch |
13 Mar 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-13 16:15
Updated : 2025-04-03 12:57
NVD link : CVE-2024-1843
Mitre link : CVE-2024-1843
JSON object : View
Products Affected
flamescorpion
- auto_affiliate_links
CWE
CWE-862
Missing Authorization