Cross-Site Request Forgery Vulnerability in WooCommerce Cloak Affiliate Links by datafeedr.com
CVE-2025-24647

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
WooCommerce Cloak Affiliate Links
Vendor
CVE Published:
24 January 2025

What is CVE-2025-24647?

A Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Cloak Affiliate Links by datafeedr.com potentially allows attackers to perform unauthorized actions on behalf of users. This weakness can be exploited when users are tricked into clicking on malicious links, resulting in unintended requests being sent to the website while the user is authenticated. Affected users should ensure they update to a secure version to mitigate risks.

Affected Version(s)

WooCommerce Cloak Affiliate Links <= 1.0.35

References

https://patchstack.com/database/wordpress/plugin/woocomme...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mika (Patchstack Alliance)
.