High severity · published Sep 3, 2019
CVE-2019-15868
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Affiliates Manager · Wpaffiliatemanager
before 2.6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15868
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15868
Release Notes
https://wordpress.org/plugins/affiliates-manager/#developers
Patch
https://wpvulndb.com/vulnerabilities/9335
More from Affiliates Manager
8.8
CVE-2023-52130
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31
8.8
CVE-2023-28986
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versions
8.0
CVE-2022-2798
The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to perform CSV injection…
7.2
CVE-2021-24844
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL…
6.1
CVE-2021-25078
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing…