Auto Affiliate Links, CVE-2024-1843

CVE, Research URL: CVE-2024-1843
Home page URL: Security reports for Auto Affiliate Links
Application: Auto Affiliate Links
Published on: Mar 13, 2024
Research Description: The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function in all versions up to, and including, 6.4.3. This makes it possible for authenticated attackers, with subscriber access or higher, to add arbitrary links to posts.
Affected versions: Min -, max 6.4.2.6.
Status: vulnerable