The flaw is a missing authorization check that permits untrusted users to access or modify the affiliate link manager. Attackers can alter link properties, inject malicious URLs, or delete existing links. The weakness corresponds to CWE‑862, which indicates a missing authorization vulnerability. The flaw allows either confidentiality exposure if sensitive link data is accessed, integrity compromise through unauthorized link modification, or availability reduction if links are destroyed.

The vulnerability affects the WordPress plugin AnyTrack Affiliate Link Manager from version 1.5.5 and earlier. All installations of the plugin in a WordPress environment are potentially impacted, regardless of the domain or hosting configuration.

The CVSS score is not publicly disclosed, and no EPSS value is available, so the exact severity cannot be quantified. Based on the description, it is inferred that the attacker can send crafted requests to the plugin’s admin endpoints without proper authentication, thereby exploiting the flaw. This results in high risk due to potential widespread abuse if the site’s admin interface is not adequately protected.