Woocommerce Cloak Affiliate Links Vulnerabilities

The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.35. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request...

CVSS:

4.3

Affected:

up to 1.0.35

Fixed in:

1.0.36

Disclosed:

Jan 24, 2025

CVE-2025-24647 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in datafeedr.com WooCommerce Cloak Affiliate Links allows Cross Site Request Forgery. This issue affects WooCommerce Cloak Affiliate Links: from n/a through 1.0.35.

Affected:

up to 1.0.36

Fixed in:

1.0.36

Disclosed:

Jan 24, 2025

CVE-2025-24647 on NVD →

[en] The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permal...

Affected:

up to 1.0.34

Fixed in:

1.0.34

Disclosed:

Apr 9, 2024

CVE-2024-1308 on NVD →

The WooCommerce Cloak Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'permalink_settings_save' function in all versions up to, and including, 1.0.33. This makes it possible for unauthenticated attackers to modify the affiliate permalink b...

CVSS:

7.5

Affected:

up to 1.0.33

Fixed in:

1.0.34

Disclosed:

Mar 20, 2024

CVE-2024-1308 on NVD →