Description:

CVE-2024-1851 is a vulnerability in the affiliate-toolkit – WordPress Affiliate Plugin for WordPress that allows authenticated attackers with subscriber-level access and above to perform unauthorized actions, such as creating product lists. This is due to a missing capability check on the atkp_create_list() function in all versions up to and including 3.5.4.

Key Insights:

• The SVRS of 42 indicates a moderate risk, highlighting the need for attention and appropriate mitigation measures.
• The vulnerability allows attackers to gain unauthorized access and perform malicious actions, potentially compromising the integrity and security of the WordPress website.
• The vulnerability is exploitable by authenticated attackers with subscriber-level access, making it accessible to a wider range of potential attackers.

Mitigation Strategies:

• Update the affiliate-toolkit – WordPress Affiliate Plugin to version 3.5.5 or later, which addresses the vulnerability.
• Implement strict access controls to limit the number of users with subscriber-level access or higher.
• Regularly monitor the website for suspicious activity and take immediate action if any unauthorized access or malicious behavior is detected.
• Consider using a web application firewall (WAF) to block malicious requests and protect against unauthorized access attempts.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: No active exploits have been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• In the Wild: There is no evidence that this vulnerability is being actively exploited by hackers.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.