ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation
Priority LOW 24CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website
Why it matters now
EPSS 0.00313 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed ThirstyAffiliates Affiliate Link Manager (Unknown): 3.10.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | ThirstyAffiliates Affiliate Link Manager | before 3.10.5 | 3.10.5 | Patch available | CNA |
- ThirstyAffiliates Affiliate Link Manager VendorUnknown Affected before 3.10.5 Fixed in 3.10.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:caseproof:thirstyaffiliates_affiliate_link_manager:*:*:*:*:*:wordpress:*:* | before 3.10.5 | Vulnerable | Caseproof, LLC |
- cpe:2.3:a:caseproof:thirstyaffiliates_affiliate_link_manager:*:*:*:*:*:wordpress:*:* Versions before 3.10.5 Vulnerable ·Caseproof, LLC
Remediation
- Fix · CNA ThirstyAffiliates Affiliate Link Manager (Unknown) Fixed in 3.10.5
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0398
- 2026-10-03 Alias added: GHSA-mvmq-p5xj-8vj6
References
More Caseproof, LLC Thirstyaffiliates Affiliate Link Manager vulnerabilities
- TI-2021-06419 ThirstyAffiliates < 3.9.3 - Authenticated Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2022-00551 ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF CVSS 3.1MEDIUM 4.3
Sources
- CVE-2022-0398 · CVE Program
- CVE-2022-0398 · NVD
- FIRST EPSS
- GHSA-mvmq-p5xj-8vj6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences