CVE-2022-0634: caseproof thirstyaffiliates_affiliate_link_manager Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2022-0634 is a medium (CVSS 5.4) Cross-Site Request Forgery (CSRF) vulnerability in caseproof thirstyaffiliates_affiliate_link_manager. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-04-2022
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.