CVE-2025-69346

MediumCVSS 4.3

Published: 06/01/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The AffiliateX plugin for WordPress (versions up to and including 1.3.9.3) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.

Risk Assessment

An unauthenticated or low-privileged user may perform actions they should not be allowed to, potentially leading to modification of plugin configuration or data.

Recommendation

Update the AffiliateX plugin to a version newer than 1.3.9.3 once a fix is available, and review WordPress role permissions.

Other vulnerabilities in AffiliateX

CVE-2026-65558Medium
The AffiliateX plugin version 2.3.5 and earlier has a Server-Side Request Forgery (SSRF) vulnerability without authentication. An unauthenticated attacker can send requests to internal resources.

Original NVD description (English source)

Missing Authorization vulnerability in WPCenter AffiliateX affiliatex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AffiliateX: from n/a through <= 1.3.9.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS