{"schemaVersion":3,"id":"CVE-2022-0398","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website","dates":{"published":"2022-04-25T15:50:57.000Z","modified":"2024-08-02T23:25:40.372Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.4,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.9,"severity":"medium","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":5.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00313,"percentile":0.22642,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00313},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00313,"percentile":0.22642}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00313,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00313,"percentile":0.22642}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_265D90A1CD7BA64E","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/21aec131-91ff-4300-ac7a-0bf31d6b2b24","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.","type":"weakness","status":"Stable","abstraction":"Compound","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/352.html"},{"id":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/862.html"}],"affected":[{"vendor":"caseproof","product":"thirstyaffiliates_affiliate_link_manager","name":"thirstyaffiliates affiliate link manager","label":"thirstyaffiliates_affiliate_link_manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.10.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.5","eol":null,"hubHref":"/vendor/caseproof/thirstyaffiliates_affiliate_link_manager"},{"vendor":"unknown","product":"thirstyaffiliates affiliate link manager","name":"ThirstyAffiliates Affiliate Link Manager","label":"thirstyaffiliates affiliate link manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.10.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.10.5","eol":null,"hubHref":"/vendor/unknown/thirstyaffiliates_affiliate_link_manager"},{"vendor":"wordpress","product":"thirstyaffiliates","name":"ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin","label":"thirstyaffiliates","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.10.4 (fixed in 3.10.5)","noFixRecorded":false,"fixedIn":"3.10.5"}],"versionsText":"≤ 3.10.4 (fixed in 3.10.5)","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/21aec131-91ff-4300-ac7a-0bf31d6b2b24","label":"wpscan.com/vulnerability/21aec131-91ff-4300-ac7a-0bf31d6b2b24","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description","Third Party Advisory"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7661d648-543e-46c8-a859-fb722a0c3fc2","label":"www.wordfence.com/threat-intel/vulnerabilities/id/7661d648-543e-46c8-a859-fb722a0c3fc2","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-04-25T15:50:57.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-02T23:25:40.372Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T14:00:06.791Z","stale":false,"partial":false}}