CVE-2023-4600
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
AffiliateWP for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to and including 2.14.0. This allows authenticated attackers with subscriber-level access and above to activate arbitrary plugins.
Risk Assessment
The organization may be exposed to the activation of malicious plugins by authenticated users, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update AffiliateWP to the latest version to eliminate this vulnerability and review user permissions to restrict access to plugin activation functions.
Original NVD description (English source)
The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to activate arbitrary plugins.