blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-3898

MEDIUM 6.5 CVSS 3.1
Published
November 29, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Description

The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it possible for unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products and versions

  • tipsandtrickshq WP Affiliate Platform — Up to and including 6.3.9
  • tipsandtricks-hq wp_affiliate_platform — Up to and including 6.3.9

References

  • www.tipsandtricks-hq.com https://www.tipsandtricks-hq.com/wordpress-affiliate-platform-plugin-simple-affiliate-program-for-wordpress-blogsite-1474 Product
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/a6096b9a-f7bb-454a-8203-50ac99d37100?source=cve
  • www.wordfence.com https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3898 Third Party Advisory
  • nvd.nist.gov Official NVD record