CVE-2024-12336

Summary

CVE-2024-12336 is a vulnerability affecting the WC Affiliate – A Complete WooCommerce Affiliate Plugin for WordPress. The issue lies in the missing capability check on the 'export_all_data' function, present in all versions up to 2.5.3. This flaw allows authenticated attackers, with a Subscriber-level access or higher, to gain unauthorized access to sensitive affiliate data. Exposed information includes personally identifiable data (PII), putting users at risk of privacy breaches. Upgrading to the latest plugin version is recommended to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.