What is the CVSS score of CVE-2026-57654?

CVE-2026-57654 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Affiliates Manager CVE-2026-57654

EUVD-2026-39769 MEDIUM

Missing Authorization (CWE-862)

2026-06-26 audit@patchstack.com

GHSA-8ph7-m94w-6fwc

WordPress Authentication Bypass Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible missing authorization requires a low-privilege authenticated user (PR:L); integrity impact is high with no confidentiality or availability consequence per the access-control-only nature of the flaw.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:09 vuln.today

DescriptionCVE.org

Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

AnalysisAI

Broken Access Control in the Affiliates Manager WordPress plugin (versions <= 2.9.49) allows an authenticated low-privilege user to perform unauthorized affiliate management actions, achieving high integrity impact due to missing authorization checks (CWE-862). The CVSS vector (PR:L, AV:N, AC:L) confirms exploitation is network-accessible with minimal complexity, requiring only a valid low-privilege account. No active exploitation has been identified at time of analysis, and no patched version has been independently confirmed from the available intelligence.

Technical ContextAI

Affiliates Manager is a WordPress plugin that provides affiliate program management functionality, including tracking, payouts, and affiliate account administration. CWE-862 (Missing Authorization) indicates the plugin fails to verify whether the authenticated requestor holds the appropriate WordPress capability or role before executing sensitive affiliate-related operations. This class of flaw is common in WordPress plugins where REST API endpoints or admin-ajax handlers perform privileged actions without capability checks. The CVSS PR:L metric confirms the flaw is reachable by any authenticated WordPress user - such as a subscriber or a registered affiliate - not just editors or administrators. The 'Authentication Bypass' tag from Patchstack further indicates the missing check allows crossing a role boundary, effectively letting lower-privileged users exercise functions reserved for higher roles.

RemediationAI

Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/affiliates-manager/vulnerability/wordpress-affiliates-manager-plugin-2-9-49-broken-access-control-vulnerability for the patched release version and update the plugin immediately once available. No specific patched version number was confirmed in the provided intelligence data - do not assume version 2.9.50 or higher is safe without verifying against the vendor changelog. As a compensating control while awaiting a patch, disable the Affiliates Manager plugin entirely on sites where affiliate functionality is non-critical. On sites where the plugin must remain active, restrict new user registrations and affiliate account creation to prevent untrusted users from obtaining the low-privilege foothold required for exploitation. Audit existing low-privilege user accounts for unusual affiliate management activity. These controls reduce exposure but do not eliminate the underlying flaw.