CVE-2022-0398

Name of the Vulnerable Software and Affected Versions ThirstyAffiliates Affiliate Link Manager WordPress plugin versions prior to 3.10.5

Description The issue is related to the lack of authorisation and CSRF checks when creating affiliate links. This could allow any authenticated user, such as a subscriber, to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website.

Recommendations For versions prior to 3.10.5, update to version 3.10.5 or later to resolve the issue. As a temporary workaround, consider restricting the ability to create affiliate links to trusted users until the update is applied.