CVE-2022-0398: ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0398?
CVE-2022-0398 is classified as a medium severity vulnerability due to the potential for unauthorized affiliate link creation.
How do I fix CVE-2022-0398?
To fix CVE-2022-0398, update the ThirstyAffiliates Affiliate Link Manager plugin to version 3.10.5 or later.
Who is affected by CVE-2022-0398?
Any authenticated user, including subscribers, can be affected by CVE-2022-0398 if they have access to the WordPress admin interface.
What are the consequences of CVE-2022-0398?
CVE-2022-0398 allows unauthorized users to create arbitrary affiliate links, potentially leading to unauthorized redirection and financial loss.
Is there a workaround for CVE-2022-0398?
Currently, the only effective workaround for CVE-2022-0398 is to upgrade the plugin to the latest version.