redefiningtheweb WordPress & WooCommerce Affiliate Program vulnerabilities

Latest redefiningtheweb WordPress & WooCommerce Affiliate Program CVEs

Newest publication first

1. CVE-2024-9289 WordPress & WooCommerce Affiliate Program <= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation

   Published 2024-10-01

   Critical·CVSS 9.8 EPSS 0.58%

   The WordPress & WooCommerce Affiliate Program plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 8.4.1. This is due to the rtwwwap_login_request_callback() function not properly validating a user's identity prior to authenticating th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.