A missing authorization flaw in the WordPress Woocommerce Envato Affiliates plugin allows users to access functionality that is not properly constrained by access control lists. Because the plugin’s settings interface can be reached without the appropriate privileges, an attacker may alter affiliate configuration parameters, potentially redirecting traffic or modifying commission structures.

The vulnerability affects the AA‑Team"s Woocommerce Envato Affiliates plugin from its earliest release through version 1.2.1. Any WordPress installation that has a plugin instance of this product and one of these versions is exposed.

The CVSS score of 7.1 indicates a moderate to high severity. No EPSS data is available, and the vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. The likely attack path is via the plugin’s settings page, which can be accessed by any user who can reach the WordPress admin area, allowing an attacker to modify the plugin configuration without proper authorization.