EUVD-2026-43140
GHSA-gm5w-p3xr-7gh2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister subscriber account on target site
-
DeliveryLoad any frontend page while authenticated
-
ExploitExtract nonce from rtwalwm_global_params JavaScript object
-
ExecutionCraft AJAX request targeting admin action handlers
-
PersistApprove fraudulent referrals and credit commissions to attacker wallet
-
ImpactWithdraw fraudulent commission payouts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress user account at subscriber level or above on the target site - anonymous unauthenticated access is insufficient. The attacker must be able to load any frontend page of the site while authenticated to extract the |
| Impact | The official CVSS score of 4.3 (I:L) underrepresents the business impact: the ability to approve fraudulent referrals and directly credit commissions to attacker-controlled affiliate wallets constitutes high-integrity financial fraud, not merely low-integrity data modification. A more accurate integrity metric is I:H given the direct monetary impact on commission payouts. Attack complexity is genuinely low (AC:L) - the nonce extraction requires only loading any page while logged in, and the exploit requires no special tooling. PR:L is confirmed by the CVSS vector (subscriber-level access suffices). There is no EPSS data in the provided intelligence, no KEV listing, and no confirmed public exploit code, which moderates urgency. However, the WordPress plugin ecosystem is a frequent target for automated credential-stuffing followed by privilege abuse, so any site with subscriber-level registrations open to the public faces meaningful exposure. The financial fraud angle - unlike typical data exposure or defacement - creates direct monetary liability for site operators, elevating prioritization beyond what the raw CVSS score suggests. |
| Exploit ScenarioDerived | An attacker registers a free subscriber account on a WooCommerce site running Affilia 3.3.3, then loads any public page to extract the nonce value from the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Unauthorized affiliate management actions in the Affilia plugin for WordPress (all versions through 3.3.3) allow any subscriber-level authenticated user to approve or reject referrals, credit commissions to affiliate wallets, delete referral records, and modify banner options - enabling direct financial fraud against WooCommerce stores. The root cause is that the sole authentication gate relies on a WordPress nonce that is publicly embedded in every frontend page load via the JavaScript global rtwalwm_global_params.rtwalwm_nonce, making role-based access enforcement trivially bypassable. No public exploit code or CISA KEV listing is identified at time of analysis, but the low exploitation complexity and direct financial fraud impact make this a meaningful operational risk for any site running an affiliate program on this plugin.
RemediationAI
A code changeset was committed to the plugin's WordPress Subversion repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3542527%40affiliaa-affiliate-program-with-mlm&new=3542527%40affiliaa-affiliate-program-with-mlm), indicating an upstream fix exists; however, a formally released patched version number is not confirmed in the available data - verify via the WordPress plugin repository whether a version beyond 3.3.3 has been released and update immediately if so. If no patched version is yet available, the primary compensating control is to disable the Affilia plugin entirely until an update ships, as the nonce exposure is architectural and cannot be mitigated by configuration alone. As a secondary control, restrict authenticated access to the WordPress site by disabling open user registration or requiring administrator approval for new accounts, which raises the bar for obtaining the subscriber-level access needed to exploit this flaw. Blocking AJAX requests to wp-admin/admin-ajax.php for non-admin roles at the WAF or reverse proxy layer targeting the plugin's action parameters (e.g., actions prefixed with rtwalwm_) can reduce exposure but risks breaking legitimate affiliate-facing functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin (CPE: cpe:2.3:a:redefiningtheweb:affiliate_program_&_referral_tracking_for_woocommerce_&_wordpress_-_affilia:*:*:*:*:*:*:*:*) integrates affiliate referral and commission tracking into WooCommerce/WordPress. Administrative AJAX actions - including referral approval, commission crediting, record deletion, and banner configuration - are protected only by a WordPress nonce check. However, the nonce is injected into every frontend page response via the rtwalwm_global_params.rtwalwm_nonce JavaScript object (confirmed in rtwalwm-class-wp-wc-affiliate-program-public.php#L127), making it readable by any authenticated browser session. WordPress nonces are CSRF tokens, not capability checks; the plugin conflates passing a nonce with authorization. CWE-862 (Missing Authorization) precisely describes this failure: the code verifies request origin but never validates whether the requesting user has the capability to perform the administrative action. Vulnerable admin action handlers are documented at lines 660, 742, 812, and 837 of rtwalwm-class-wp-wc-affiliate-program-admin.php in both the trunk and 3.3.3 tag.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L confirmed by subscriber-level requirement; I:H reflects direct financial fraud via commission manipulation; A:L for referral record deletion capability.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Affilia - Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, enabling financial fraud. The nonce required to pass the only authentication check is embedded in every frontend page load via rtwalwm_global_params.rtwalwm_nonce, making it trivially accessible to any authenticated user regardless of role.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB