CVE-2024-1308CWE-284

WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification

High · published April 9, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink base, driving traffic to malicious sites via the plugin's affiliate links.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00742 · 54.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-04-09T18:58Z
EPSS history
Timeline
  • 09 APR 18:58Z
    WooCommerce Cloak Affiliate Links <= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification
    cvelistv5