The vulnerability is a broken access control flaw in the VillaTheme AFFI – Affiliate Marketing for WooCommerce WordPress plugin. An attacker who can send a crafted request to the plugin’s privileged endpoints can bypass authorization checks and gain unauthorized access to administrative features, potentially modifying affiliate settings or viewing sensitive data. The weakness is categorized as CWE-862, indicating improper validation of user permissions.

The issue affects the VillaTheme AFFI – Affiliate Marketing for WooCommerce plugin for WordPress, from the earliest unreleased version through 1.0.9. Any site implementing the plugin in those versions is vulnerable. Upgrading to 1.0.10 or later removes the flaw.

The CVSS score of 5.3 places the flaw in the medium severity range. The EPSS score is not available; it is not listed in CISA’s KEV catalog. Likely exploitation requires the attacker to be able to communicate with the site’s HTTP endpoints, which is often possible over the Internet. Once access is gained, the attacker can alter affiliate parameters or potentially broaden the attack surface by leveraging the plugin’s internal API.