EUVD-2026-92956
GHSA-4xgv-rgwf-w2rv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliverySend crafted HTTP request to unprotected endpoint
-
ExploitBypass missing authorization check (CWE-862)
-
ExecutionModify affiliate data or state
-
ImpactUnauthorized integrity impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected software must be the Fluent Affiliate Pro WordPress plugin at version 1.6.4 or earlier, installed and active on a reachable WordPress site. The vector is unauthenticated (PR:N) with no user interaction (UI:N) and network-reachable (AV:N), so exploitation works against a default installation with no special configuration prerequisites stated in the description. The primary limiting factors are therefore not configuration but deployment scope: the target must specifically run this particular affiliate plugin at a vulnerable version, which narrows the real-world attack surface. Impact is bounded to integrity (I:H; C:N/A:N), meaning successful exploitation enables unauthorized modification of plugin/affiliate data rather than disclosure or denial of service. |
| Impact | The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction and a high integrity impact but no confidentiality or availability impact - consistent with CWE-862 (Missing Authorization) and the 'Unauthenticated Broken Access Control' description. This is a genuinely attacker-favorable profile (remote, no auth, no interaction), so the technical barrier to abuse is low. However, no EPSS score, KEV listing, SSVC decision data, or POC availability was provided in the input, so exploitation likelihood cannot be quantified: there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals therefore do not conflict so much as remain incomplete - the access-control profile is favorable to attackers, but without EPSS/KEV/POC data this should be treated as a 'patch-promptly' issue rather than a confirmed emergency. The real-world priority is further tempered by the product's limited deployment footprint (a niche WordPress affiliate plugin) and the integrity-only impact (C:N/A:N), which bounds the worst-case outcome to unauthorized data modification rather than data theft or outage. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running Fluent Affiliate Pro <= 1.6.4, invoking a plugin endpoint or action that fails to verify the caller's authorization. Because no authentication or user interaction is required (PR:N/UI:N), the attacker can manipulate affiliate-related state or data (integrity impact, I:H) directly against a default installation. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector and CWE-862 classification. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Fluent Affiliate Pro, a WordPress affiliate-management plugin maintained by WP Manage Ninja, fails to enforce authorization checks on certain requests in versions 1.6.4 and earlier, allowing unauthenticated remote attackers to perform actions they should not be permitted to perform (CWE-862). The flaw carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning exploitation requires no credentials, no user interaction, and no special configuration, but its impact is confined to integrity - attackers can modify affiliate or plugin data, with no confidentiality or availability impact assessed. No public exploit code has been identified and no CISA KEV entry exists at the time of analysis, so the practical risk is driven mainly by whether a given site runs this specific plugin at a vulnerable version, which limits the real-world attack surface.
RemediationAI
No vendor-released patch or fixed version is identified in the available data - Patchstack's advisory documents the vulnerability in versions up to and including 1.6.4 but no remediating release is cited - so the primary recommendation is to monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/fluent-affiliate-pro/vulnerability/wordpress-fluent-affiliate-pro-plugin-1-6-4-broken-access-control-vulnerability?_s_id=cve) and the WP Manage Ninja plugin page for a fixed release and upgrade as soon as one is published. If Fluent Affiliate Pro is not essential to the site, deactivating and removing the plugin eliminates the exposure entirely; the trade-off is loss of affiliate tracking and reporting for existing referral programs. Where the plugin must remain active, restrict network access to the affected request paths - block unauthenticated POST/AJAX calls against the plugin's endpoints at the WAF or reverse proxy and apply virtual patching rules for the Fluent Affiliate Pro action names - accepting that this may break legitimate affiliate front-end flows that rely on the same handlers. Additional compensating controls with lower functional risk include placing the site behind a WAF with WordPress-aware rule sets, enabling request logging and alerting on unexpected writes to affiliate data, and limiting plugin administrative capabilities to a minimal set of trusted accounts; none of these remove the underlying missing-authorization flaw, so they should be treated as temporary mitigations until a patched version is confirmed available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a commercial WordPress plugin that extends affiliate-tracking and referral functionality on WordPress sites. The root-cause class is CWE-862 (Missing Authorization): the plugin exposes one or more endpoints or actions (typically WordPress AJAX handlers, REST routes, or admin-post hooks) that perform state-changing operations without verifying that the requesting user holds the required capability or nonce. Because the vulnerable code path is reachable over the network with PR:N/UI:N per the CVSS vector, an attacker does not need an account on the target site; they only need network reachability to the WordPress installation and knowledge of the relevant request format. The CPE entry cpe:2.3:a:wp_manage_ninja:fluent_affiliate_pro:*:*:*:*:*:*:*:* confirms the affected product namespace (WP Manage Ninja / Fluent Affiliate Pro) and uses a wildcard version, so the binding version constraint is the one stated in the advisory: all releases up to and including 1.6.4. The integrity-only scoring (I:H, C:N/A:N) indicates the unguarded operations alter data - for example affiliate records, settings, or status fields - rather than exfiltrating stored information or taking the site offline.
Know when Fluent Affiliate Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Broken access control is network-exploitable with no auth or interaction (AV:N/AC:L/PR:N/UI:N), and the missing-authorization flaw permits unauthorized data modification only, so I:H with C:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
Executive ViewAI
Sites running the Fluent Affiliate Pro WordPress plugin at versions 1.6.4 or earlier are exposed to unauthenticated attackers modifying affiliate or plugin data, which can disrupt affiliate program integrity and partner trust. No vendor-released patch is identified at this time, and no public exploit identified at time of analysis, so risk is concentrated among organizations that have this plugin deployed. Leadership should direct immediate inventory and mitigation for affected WordPress properties, especially where affiliate data drives revenue or partner relationships.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing Fluent Affiliate Pro versions 1.6.4 and earlier, restricting access to affiliate functionality, deploying WAF rules to block unauthorized requests, monitoring affiliate and plugin data for unauthorized modifications, and maintaining recent backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB