CVE-2024-5285

WP Affiliate Platform < 6.5.2 - Affiliate Deletion via CSRF

Medium · published July 29, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

The wp-affiliate-platform WordPress plugin before 6.5.2 does not have CSRF check in place when deleting affiliates, which could allow attackers to make a logged in user change delete them via a CSRF attack

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.0th percentile
Published
2024-07-29T06:00Z
EPSS history
Timeline
  • 29 JUL 06:00Z
    WP Affiliate Platform < 6.5.2 - Affiliate Deletion via CSRF
    cvelistv5