CVE-2024-1851

Summary

CVE-2024-1851 is a vulnerability affecting the WordPress Affiliate Plugin, specifically the affiliate-toolkit. This issue arises from a missing capability check on the atkp_create_list() function, which is present in all versions up to 3.5.4. Consequently, authenticated attackers, including those with subscriber-level access and above, can exploit this flaw to execute unauthorized actions, such as creating product lists, thereby posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.