What is the CVSS score of EUVD-2025-209937?

EUVD-2025-209937 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Woocommerce Envato Affiliates are affected by EUVD-2025-209937?

The AA-Team Woocommerce Envato Affiliates WordPress plugin (versions up to 1.2.1) contains a missing authorization vulnerability allowing low-privileged authenticated users to modify administrative…

How to fix or mitigate EUVD-2025-209937?

Within 24 hours: Deactivate the AA-Team Woocommerce Envato Affiliates plugin or restrict plugin settings access to administrator roles only using WordPress role-based access controls. Within 7 days: Audit all server and database logs for unauthorized plugin configuration changes; review affiliate user account privileges and revoke unnecessary administrative capabilities. Within 30 days: Monitor vendor and Patchstack channels for security patch release; develop testing and deployment procedures for immediate application once patches become available.

Woocommerce Envato Affiliates EUVD-2025-209937

| CVE-2025-14361 HIGH

Missing Authorization (CWE-862)

2026-05-26 audit@patchstack.com

GHSA-vfhv-g4cg-63x2

WordPress Authentication Bypass

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 26, 2026 - 21:30 vuln.today

CVE Published

May 26, 2026 - 21:16 nvd

HIGH 7.1

DescriptionCVE.org

Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1.

AnalysisAI

Missing authorization in the AA-Team Woocommerce Envato Affiliates WordPress plugin (versions up to and including 1.2.1) lets a low-privileged authenticated user invoke functionality that is not properly gated by access-control checks, most likely modifying plugin settings as indicated by the Patchstack advisory slug. Because the action carries a high integrity impact, an attacker holding even a basic account can tamper with configuration that should be reserved for administrators. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is rooted in CWE-862 (Missing Authorization): the plugin exposes an action - per the reference, a settings-change handler - without verifying that the calling user holds the required capability or role. WordPress plugins typically protect such handlers with capability checks (e.g. current_user_can) and nonce validation; when those checks are absent or insufficient, any authenticated session can reach functionality intended only for higher-privileged roles. The affected component is the Woocommerce Envato Affiliates plugin developed by AA-Team, which integrates Envato affiliate/marketplace functionality into WooCommerce-based WordPress stores. No CPE string was supplied in the input, so the exact affected configuration identifier is not independently confirmed beyond the plugin name and version range.

RemediationAI

No vendor-released patch version is identified in the available data, so no exact upgrade target can be cited; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wooenvato/vulnerability/wordpress-woocommerce-envato-affiliates-plugin-1-2-1-settings-change-vulnerability) and the plugin vendor for a release later than 1.2.1 and upgrade as soon as one is published. As compensating controls until a fix is confirmed, restrict who can hold authenticated accounts on the site and audit low-privileged roles (subscriber/customer) since those are the likely abuse vector; consider deactivating the Woocommerce Envato Affiliates plugin if its affiliate functionality is non-essential, accepting the trade-off of losing Envato affiliate integration. A WordPress WAF (including Patchstack's own virtual patching) can block the unauthorized settings-change request at the edge, though this is mitigation rather than a true fix and may require tuning to avoid breaking legitimate plugin actions.