WC Affiliate – A Full-fledged Affiliate Manager for WooCommerce, CVE-2024-12336

CVE, Research URL: CVE-2024-12336
Home page URL: Security reports for WC Affiliate – A Full-fledged Affiliate Manager for WooCommerce
Application: WC Affiliate – A Full-fledged Affiliate Manager for WooCommerce
Published on: Mar 15, 2025
Research Description: The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'export_all_data' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to expose sensitive affiliate data, including personally identifiable information (PII).
Affected versions: Min -, max 2.6.
Status: vulnerable