Vulnerability · Published Aug 5, 2022 · Assigned by Patchstack
CVE-2022-36284WordPress Affiliate For WooCommerce premium plugin <= 4.7.0 - Authenticated IDOR vulnerability leading to PayPal email change
Medium 6.4
In plain English
A medium-severity authorization bypass via user-controlled key in Affiliate For WooCommerce (WordPress plugin) from StoreApps. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.7%top 48.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| StoreApps | Affiliate For WooCommerce (WordPress plugin) | <= 4.7.0 – through 4.7.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
References
- https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt x_refsource_CONFIRM
- https://patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-authenticated-idor-vulnerability-leading-to-paypal-email-change x_refsource_CONFIRM