CVE-2024-1851

CVE-2024-1851 is a medium-severity unauthorized access vulnerability affecting the affiliate-toolkit WordPress plugin, versions up to and including 3.5.4. It allows authenticated attackers, even those with subscriber-level privileges, to create product lists due to a missing capability check. The CVSS score is 6.5, indicating a network-based attack with low complexity and high integrity impact, though no confidentiality or availability impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.