Loris4Py

**Name of the Vulnerable Software and Affected Versions** Affilia – Affiliate Program & Referral Tracking for WordPress versions prior to 3.3.4 **Description** An unauthorized access issue exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, which may lead to financial fraud. The authentication check relies on a nonce that is embedded in every frontend page load via the `rtwalwm global params.rtwalwm nonce` variable, making it accessible to any authenticated user. **Recommendations** Update to a version newer than 3.3.3.