Affiliate Pro EUVD-2026-64804

The only firm prerequisite from the available data is that a vulnerable version (≤ 8.9.1) of the Affiliate Pro plugin is installed and active on a reachable WordPress/WooCommerce site; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and no elevated privileges are required, so exploitation works remotely against exposed installations. The description does not name a specific non-default feature toggle or configuration that must be enabled, so the practical limiting factor is simply exposure of the plugin's endpoints to the attacker; defenders should confirm via the Patchstack advisory whether any affiliate-program feature must be active, as that detail was not provided in the input.

The signals are consistent and point to genuine priority rather than an inflated score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity, and availability impact, and CWE-266 privilege-escalation flaws in WordPress plugins are historically reliable to weaponize. No EPSS score, KEV listing, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input, and there is no public exploit identified at time of analysis - meaning risk is currently driven by exploitability and exposure rather than confirmed activity. Because privilege escalation on a WooCommerce store can lead to full site takeover and customer-data exposure, even a mid-sized operator running an e-commerce site should treat this as urgent and patch promptly. The main uncertainty is the exact exploitation prerequisite: the description labels the flaw 'unauthenticated,' which matches PR:N, but no vendor writeup detail was provided to confirm whether any plugin feature must be enabled - verify against the Patchstack advisory.

An attacker sends crafted requests to the plugin's affiliate registration or role-assignment endpoint on a public WooCommerce store, with no login required, and manipulates the request so the server assigns them an elevated privilege level. With administrative capability they install a malicious plugin or webshell to fully control the site and exfiltrate customer and order data. No public exploit identified at time of analysis, but the network vector and low complexity make reliable exploitation straightforward once the flaw is understood.