What is the CVSS score of CVE-2026-24592?

CVE-2026-24592 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Auto Affiliate Links CVE-2026-24592

EUVD-2026-31748 MEDIUM

Missing Authorization (CWE-862)

2026-05-25 Patchstack

GHSA-64j4-wv48-vxg4

WordPress Authentication Bypass Auto Affiliate Links Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:53 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Auto Affiliate Links: from n/a through 6.8.8.3.

AnalysisAI

Missing authorization in the Auto Affiliate Links WordPress plugin (all versions through 6.8.8.3) allows unauthenticated remote attackers to bypass access control checks and perform unauthorized write operations against affiliate link configurations. The vulnerability is classified as broken access control (CWE-862) and was reported by Patchstack. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.03% (8th percentile) and SSVC exploitation status is 'none' - indicating negligible real-world threat activity at time of analysis despite the attack being fully automatable with no authentication required.

Technical ContextAI

The affected component is the Auto Affiliate Links plugin authored by Lucian Apostol, identified by CPE cpe:2.3:a:lucian_apostol:auto_affiliate_links:*:*:*:*:*:*:*:*. CWE-862 (Missing Authorization) describes a failure to perform any authorization check before executing a sensitive operation - the plugin exposes one or more WordPress AJAX endpoints or admin-facing actions without verifying whether the caller holds an appropriate capability (e.g., manage_options or a custom role). WordPress plugins commonly register wp_ajax_nopriv_ hooks that are reachable without authentication; if sensitive functionality is tied to such hooks without a nonce or capability check, any network-reachable party can invoke it. The integrity-only impact (CVSS C:N/I:L/A:N) suggests the exploitable surface modifies plugin settings or affiliate link data rather than reading sensitive records or crashing the service.

RemediationAI

Update the Auto Affiliate Links plugin to a version beyond 6.8.8.3 if a patched release has been published to the WordPress plugin repository; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-auto-affiliate-links/vulnerability/wordpress-auto-affiliate-links-plugin-6-8-8-3-broken-access-control-vulnerability for the confirmed fixed version, as no specific patch version was present in the data available at time of analysis. If no patched version is yet available, the most effective compensating control is to deactivate and remove the plugin until a fix is released - this eliminates the attack surface entirely with no functional trade-off beyond loss of affiliate link automation. Alternatively, a WAF rule blocking unauthenticated POST requests to the affected plugin's AJAX action names can reduce exposure, though the specific action identifiers would need to be extracted from plugin source code. Restricting wp-admin access and WordPress REST/AJAX endpoints to authenticated sessions via server-level controls (e.g., HTTP Basic Auth on /wp-admin/ or /wp-login.php) would also reduce the exploitable surface as a layered defense.