CVE-2024-1851

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkpcreatelist function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2024-1851

CVE-2024-1851 affects the WordPress plugin “affiliate-toolkit – WordPress Affiliate Plugin.” The vulnerability is a broken access control due to a missing capability check in the function atkp_create_list(), present in all versions up to and including 3.5.4. This allows authenticated attackers wi...

WordPress affiliate-toolkit Plugin <= 3.5.4 is vulnerable to Broken Access Control

Software affiliate-toolkit Type Plugin Vulnerable versions = 3.5.4 Fixed in 3.5.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1851 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 2242c759db29 Credits Lucio Sá Required...