Junglewise Threat Intelligence

CVE-2026-7559: redefiningtheweb Affilia WordPress plugin unauthorized access

CVE-2026-7559 · Severity: medium · CVSS 4.3 · Published 2026-07-11

Executive brief

The Affilia plugin for WordPress, which manages affiliate marketing and referral tracking, contains a security flaw that allows low-level users to perform administrative actions. An attacker with a basic subscriber account could approve or reject referrals, manipulate commission payments, and delete records. This could lead to financial fraud and unauthorized changes to the affiliate program's settings.

Technical details

The Affilia plugin for WordPress (up to version 3.3.3) is vulnerable to missing authorization (CWE-862). The plugin fails to perform capability checks on several administrative functions, relying solely on a nonce for security. However, this nonce is globally exposed in the frontend via 'rtwalwm_global_params.rtwalwm_nonce', making it accessible to any authenticated user. An attacker with subscriber-level permissions can exploit this to approve/reject referrals, credit commissions to wallets, delete referral records, and modify banner options. The vulnerability is addressed in newer versions via improved authorization checks.

Affected products

  • redefiningtheweb Affiliate Program & Referral Tracking for WooCommerce & WordPress – Affilia up to, and including, 3.3.3

Timeline

  • 2026-07-11: disclosed
  • 2026-07-11: advisory

References