Af Companion Vulnerabilities

The AF Companion plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.0. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for authenticated attackers, with shop manager-level access and above, to execute arbitrar...

CVSS:

7.2

(Wordfence)

Affected:

up to 2.1.0

Fixed in:

2.2.0

Disclosed:

Sep 16, 2026

CVE-2026-84738 on NVD →

The AF Companion plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.1.0 to 1.1.2. This is due to missing or incorrect nonce validation on the aftc_install_activate_plugins action. This makes it possible for unauthenticated attackers to to enable or disable arbitrary plugins via a forged requ...

CVSS:

5.4

(Wordfence)

Affected:

1.1.0 – 1.1.2

Fixed in:

1.2.0

Disclosed:

Dec 27, 2021