CVE-2024-12336 affects the WC Affiliate – A Complete WooCommerce Affiliate Plugin for WordPress, specifically versions up to and including 2.5.3. This vulnerability allows authenticated users, even those with Subscriber-level access, to export sensitive affiliate data, including PII, due to a missing capability check in the 'export_all_data' function. Rated 6.5 MEDIUM on the CVSS scale, this flaw has a low attack complexity and requires only low privileges to exploit, potentially leading to high confidentiality impact without affecting integrity or availability. The EPSS score is low, indicating a low probability of exploitation. Currently, there is no evidence of active exploitation, nor is public exploit code available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.6CPE matchmatch criteria | cpe:2.3:a:codexpert:wc_affiliate:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.