CVE-2024-1843
First published: Wed Mar 13 2024(Updated: )
The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function in all versions up to, and including, 6.4.3. This makes it possible for authenticated attackers, with subscriber access or higher, to add arbitrary links to posts.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Auto Affiliate Links | <6.4.3.1 | |
| WordPress Auto Affiliate Links | <=6.4.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/wp-auto-affiliate-links/trunk/aal_ajax.php#L79
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3044067%40wp-auto-affiliate-links&new=3044067%40wp-auto-affiliate-links&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/09e5aa34-ab28-4349-ac5f-6a0479e641e5?source=cve
Frequently Asked Questions
What is the severity of CVE-2024-1843?
CVE-2024-1843 is considered a high severity vulnerability due to the potential for unauthorized data modification.
How do I fix CVE-2024-1843?
To fix CVE-2024-1843, update the Auto Affiliate Links plugin to version 6.4.3.1 or later.
Who is affected by CVE-2024-1843?
Authenticated users with subscriber access or higher on WordPress sites using the affected versions of the Auto Affiliate Links plugin are at risk from CVE-2024-1843.
What impacts does CVE-2024-1843 have?
CVE-2024-1843 allows authenticated attackers to modify data, potentially compromising the integrity of the site's content.
What versions are impacted by CVE-2024-1843?
All versions of the Auto Affiliate Links plugin up to and including 6.4.3 are impacted by CVE-2024-1843.
- agent/references
- agent/description
- agent/author
- agent/type
- agent/weakness
- agent/severity
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup-request
- agent/tags
- vendor/flamescorpion
- canonical/auto affiliate links
- vendor/wordpress
- canonical/wordpress auto affiliate links