CVE-2024-0859

2024-02-0521:21:42

Wordfence

raw.githubusercontent.com

affiliates manager

wordpress

cross-site request forgery

nonce validation

listaffiliatestable.php

unauthenticated attackers

site administrator

6.3 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.9%

JSON

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the process_bulk_action function in ListAffiliatesTable.php. This makes it possible for unauthenticated attackers to delete affiliates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.