CVE-2026-7559

Name of the Vulnerable Software and Affected Versions Affilia – Affiliate Program & Referral Tracking for WordPress versions prior to 3.3.4

Description An unauthorized access issue exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, which may lead to financial fraud. The authentication check relies on a nonce that is embedded in every frontend page load via the rtwalwm global params.rtwalwm nonce variable, making it accessible to any authenticated user.

Recommendations Update to a version newer than 3.3.3.