VulnSocial

CVE-2026-7559Disclosure

LOWCVSS 4.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to approve or reject affiliate referrals, credit commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, enabling financial fraud. The nonce required to pass the only authentication check is embedded in every frontend page load via rtwalwm_global_params.rtwalwm_nonce, making it trivially accessible to any authenticated user regardless of role.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-11: 2Technical Details · 2026-07-11: 207-11
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
By indicator
Full discourse2 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-7559 The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3.… https://www.cve.org/CVERecord?id=CVE-2026-7559 ----- Traducción: CVE-2026-7559 The… http://infoflow.cloud`

    Post summary

    The text announces CVE‑2026‑7559 as an unauthorized access flaw affecting the Affilia plugin through v3.3.3, linking to its CVE record.

    1000039
    92 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-7559 The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.3.3.… https://www.cve.org/CVERecord?id=CVE-2026-7559

    Post summary

    CVE-2026-7559 is identified as an unauthorized access vulnerability affecting the Affilia WordPress plugin up to version 3.3.3. No proof of concept, exploit code, active exploitation evidence, or mitigation steps are provided.

    000001.2K
    57.8K followersView on X

Explore more

Back to dashboard