Volerion logoVolerion
Volerion logoVolerion

WC Affiliate WooCommerce Plugin Missing Capability Check Vulnerability Allowing Data Export

Vulnerability

A vulnerability exists in the WC Affiliate – A Complete WooCommerce Affiliate Plugin for WordPress, in all versions through 2.5.3. The issue arises from a missing capability check in the 'export_all_data' function, which allows authenticated users with Subscriber-level access and above to export sensitive affiliate information, including personally identifiable information (PII).

Impact

Exploitation of this vulnerability could lead to unauthorized access and exposure of sensitive affiliate data, including PII.

Remediation

Users can update to version 2.6 or a newer patched version to address this vulnerability.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
1.0
impact
2.5
exploitability
6.1
remediation
7.7
relevance
0.0
threat
3.2
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.