CVE-2024-2298: Servit Affiliate-Toolkit

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_import_product() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating importing products.

Affected products

• Servit Affiliate-Toolkit: before 3.5.5 (fixed in 3.5.5)

Published 2024-03-08. Last modified 2026-06-17.