EUVD-2026-43140
GHSA-gm5w-p3xr-7gh2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L confirmed by subscriber-level requirement; I:H reflects direct financial fraud via commission manipulation; A:L for referral record deletion capability.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Affilia - Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, enabling financial fraud. The nonce required to pass the only authentication check is embedded in every frontend page load via rtwalwm_global_params.rtwalwm_nonce, making it trivially accessible to any authenticated user regardless of role.
AnalysisAI
Unauthorized affiliate management actions in the Affilia plugin for WordPress (all versions through 3.3.3) allow any subscriber-level authenticated user to approve or reject referrals, credit commissions to affiliate wallets, delete referral records, and modify banner options - enabling direct financial fraud against WooCommerce stores. The root cause is that the sole authentication gate relies on a WordPress nonce that is publicly embedded in every frontend page load via the JavaScript global rtwalwm_global_params.rtwalwm_nonce, making role-based access enforcement trivially bypassable. No public exploit code or CISA KEV listing is identified at time of analysis, but the low exploitation complexity and direct financial fraud impact make this a meaningful operational risk for any site running an affiliate program on this plugin.
Technical ContextAI
The plugin (CPE: cpe:2.3:a:redefiningtheweb:affiliate_program_&_referral_tracking_for_woocommerce_&_wordpress_-_affilia:*:*:*:*:*:*:*:*) integrates affiliate referral and commission tracking into WooCommerce/WordPress. Administrative AJAX actions - including referral approval, commission crediting, record deletion, and banner configuration - are protected only by a WordPress nonce check. However, the nonce is injected into every frontend page response via the rtwalwm_global_params.rtwalwm_nonce JavaScript object (confirmed in rtwalwm-class-wp-wc-affiliate-program-public.php#L127), making it readable by any authenticated browser session. WordPress nonces are CSRF tokens, not capability checks; the plugin conflates passing a nonce with authorization. CWE-862 (Missing Authorization) precisely describes this failure: the code verifies request origin but never validates whether the requesting user has the capability to perform the administrative action. Vulnerable admin action handlers are documented at lines 660, 742, 812, and 837 of rtwalwm-class-wp-wc-affiliate-program-admin.php in both the trunk and 3.3.3 tag.
RemediationAI
A code changeset was committed to the plugin's WordPress Subversion repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3542527%40affiliaa-affiliate-program-with-mlm&new=3542527%40affiliaa-affiliate-program-with-mlm), indicating an upstream fix exists; however, a formally released patched version number is not confirmed in the available data - verify via the WordPress plugin repository whether a version beyond 3.3.3 has been released and update immediately if so. If no patched version is yet available, the primary compensating control is to disable the Affilia plugin entirely until an update ships, as the nonce exposure is architectural and cannot be mitigated by configuration alone. As a secondary control, restrict authenticated access to the WordPress site by disabling open user registration or requiring administrator approval for new accounts, which raises the bar for obtaining the subscriber-level access needed to exploit this flaw. Blocking AJAX requests to wp-admin/admin-ajax.php for non-admin roles at the WAF or reverse proxy layer targeting the plugin's action parameters (e.g., actions prefixed with rtwalwm_) can reduce exposure but risks breaking legitimate affiliate-facing functionality.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today