VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Aug 30, 2023· Updated Jun 17, 2026

CVE-2023-4600

CVE-2023-4600

Description

The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to activate arbitrary plugins.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Affiliatewp/Affiliatewp2 versions
    cpe:2.3:a:affiliatewp:affiliatewp:*:*:*:*:*:wordpress:*:*+ 1 more
    • cpe:2.3:a:affiliatewp:affiliatewp:*:*:*:*:*:wordpress:*:*range: <=2.14.0
    • (no CPE)range: 2.14.0
  • WordPress/Affiliatewpllm-fuzzy
    Range: <=2.14.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.