CVE-2023-4600: Affiliatewp

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_addons_page_plugin' function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to activate arbitrary plugins.

Affected products

• Affiliatewp Affiliatewp: up to and including 2.14.0

Published 2023-08-30. Last modified 2026-06-17.