blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-36284

MEDIUM 6.5 CVSS 3.1
Published
August 5, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
audit@patchstack.com
Weakness
CWE-639
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page.

Affected products and versions

  • StoreApps Affiliate For WooCommerce (WordPress plugin) — From <= 4.7.0 (including) to 4.7.0 (including)
  • storeapps affiliate_for_woocommerce — Up to and including 4.7.0

References

  • dzv365zjfbd8v.cloudfront.net https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt Release Notes, Third Party Advisory
  • patchstack.com https://patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-authenticated-idor-vulnerability-leading-to-paypal-email-change Third Party Advisory
  • nvd.nist.gov Official NVD record