EUVD-2025-209937
GHSA-vfhv-g4cg-63x2
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
2DescriptionNVD
Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1.
AnalysisAI
Missing authorization in the AA-Team Woocommerce Envato Affiliates WordPress plugin (versions up to and including 1.2.1) lets a low-privileged authenticated user invoke functionality that is not properly gated by access-control checks, most likely modifying plugin settings as indicated by the Patchstack advisory slug. Because the action carries a high integrity impact, an attacker holding even a basic account can tamper with configuration that should be reserved for administrators. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
The flaw is rooted in CWE-862 (Missing Authorization): the plugin exposes an action - per the reference, a settings-change handler - without verifying that the calling user holds the required capability or role. WordPress plugins typically protect such handlers with capability checks (e.g. current_user_can) and nonce validation; when those checks are absent or insufficient, any authenticated session can reach functionality intended only for higher-privileged roles. The affected component is the Woocommerce Envato Affiliates plugin developed by AA-Team, which integrates Envato affiliate/marketplace functionality into WooCommerce-based WordPress stores. No CPE string was supplied in the input, so the exact affected configuration identifier is not independently confirmed beyond the plugin name and version range.
RemediationAI
No vendor-released patch version is identified in the available data, so no exact upgrade target can be cited; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wooenvato/vulnerability/wordpress-woocommerce-envato-affiliates-plugin-1-2-1-settings-change-vulnerability) and the plugin vendor for a release later than 1.2.1 and upgrade as soon as one is published. As compensating controls until a fix is confirmed, restrict who can hold authenticated accounts on the site and audit low-privileged roles (subscriber/customer) since those are the likely abuse vector; consider deactivating the Woocommerce Envato Affiliates plugin if its affiliate functionality is non-essential, accepting the trade-off of losing Envato affiliate integration. A WordPress WAF (including Patchstack's own virtual patching) can block the unauthorized settings-change request at the edge, though this is mitigation rather than a true fix and may require tuning to avoid breaking legitimate plugin actions.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Remote code execution in the WPCode WordPress plugin (versions through 2.3.5) lets authenticated author-level users run
Share
External POC / Exploit Code
Leaving vuln.today