CVE-2026-7559: Affilia Plugin Missing Authorization Vulnerability

Vulnerability Overview Vulnerability Name: Affilia <= 3.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Status Modification CVE ID: CVE-2026-7559 CVSS Score: 4.3 (Medium) Release Date: July 10, 2026 Last Updated: July 11, 2026 Researcher: Ionis4py Impact Scope Affected Versions: Affilia <= 3.3.3 Vulnerability Description: The Affilia plugin versions 3.3.3 and earlier contain an authorization bypass vulnerability. The plugin fails to properly verify if a user has the necessary permissions to perform an action, allowing an attacker with subscriber-level access to approve or deny affiliate referrals, send commissions to affiliate wallets, delete referral records, and modify custom banner plugin options, leading to financial fraud. The nonce token used when loading the frontend page serves only as a unique authentication check, enabling any authenticated user to exploit this vulnerability. Remediation Fixed Version: Upgrade to version 3.3.4 or higher Patch Status: Fixed References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: affilia-affiliate-program-with-mlm Patch Status: Fixed Affected Versions: <= 3.3.3 Patch Version: 3.3.4 Disclaimer This record contains copyrighted material. Copyright: 2012-2026 Defiant Inc. and 1995-2026 The MITRE Corporation. Contact To add information or report errors, please contact: wfsupport@wordfence.com Business Hours Weekdays: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Customer Response: 24/7 support, 365 days a year, with a 1-hour response time Other Links Terms of Service Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information Social Media Facebook Twitter LinkedIn Email Subscribe Enter email address to subscribe to news and updates Check box to agree to Terms of Service and Privacy Policy Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Register to receive news and updates from our team of experienced security professionals Subscribe Enter email address to subscribe to news and updates Check box to agree to Terms of Service and Privacy Policy Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Register to receive news and updates from our team of experienced security professionals Subscribe Enter email address to subscribe to news and updates Check box to agree to Terms of Service and Privacy Policy Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Register to receive news and updates from our team of experienced security professionals Subscribe Enter email address to subscribe to news and updates Check box to agree to Terms of Service and Privacy Policy Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Register to receive news and updates from our team of experienced security professionals Subscribe Enter email address to subscribe to news and updates Check box to agree to Terms of Service and Privacy Policy Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central Support Documentation Learning Center Free Support Premium Support News Blog In The News Vulnerability Advisories About About Wordfence Affiliate Program Employment Contact Security CVE Request Form Stay Updated Register to receive news and updates from our team of experienced security professionals Subscribe Enter email address to subscribe to news and updates Check box to agree to Terms of Service and Privacy Policy Copyright © 2012-2026 Defiant Inc. All Rights Reserved Other Wordfence Free Wordfence Premium Wordfe

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-7559: Affilia Plugin Missing Authorization Vulnerability

More from this source