Unauthorized Data Access in WC Affiliate Plugin for WordPress

CVE-2024-12336

What is CVE-2024-12336?

The WC Affiliate – A Complete WooCommerce Affiliate Plugin for WordPress contains a security flaw that allows authenticated users with Subscriber-level access and above to bypass security measures concerning the 'export_all_data' function. This vulnerability facilitates unauthorized access to sensitive affiliate data, including personally identifiable information (PII). All versions up to and including 2.5.3 are affected, making it crucial for users to implement security updates promptly to mitigate potential data breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References