CSRF in Affiliates Manager Plugin for WordPress
CVE-2019-15868

8.8HIGH

Key Information:

Vendor
Wordpress
Status
Affiliates Manager
Vendor
CVE Published:
3 September 2019

Summary

The Affiliates Manager plugin for WordPress, before version 2.6.6, is susceptible to Cross-Site Request Forgery (CSRF) attacks. This issue allows an attacker to execute unauthorized actions on behalf of an authenticated user by tricking them into clicking on a malicious link. Users should ensure they update the plugin to version 2.6.6 or later to mitigate possible exploitation.

References

https://wordpress.org/plugins/affiliates-manager/#developers
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9335
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.