CVE-2023-4600

Summary

CVE-2023-4600 is a vulnerability affecting the AffiliateWP plugin for WordPress. This issue allows authenticated attackers with subscriber-level access or higher to unauthorizedly modify data. The root cause is a missing capability check on the 'affwp_activate_addons_page_plugin' function, which can be exploited through an AJAX action. Versions up to and including 2.14.0 are affected, making it essential for users to upgrade to a patched version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.