Now officially on WordPress.org

CVE Database / CVE-2022-0398

CVE · Medium

CVE-2022-0398 — ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin [thirstyaffiliates] < 3.10.5

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-0398 ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin [thirstyaffiliates] < 3.10.5 Cross-Site Request Forgery (CSRF) Medium 5.4 < 3.10.5 3.10.5 2022-03-31 —

CVE-2022-0398

The ThirstyAffiliates plugin versions before 3.10.5 lack proper authorization and CSRF protection during affiliate link creation, permitting any authenticated user including those with subscriber-level access to generate affiliate links pointing to arbitrary websites. This vulnerability enables low-privileged accounts to potentially redirect site visitors to malicious or unintended destinations.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings