CVE-2022-36284

Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page.

• CWE-639
• CWE-639

• https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txtRelease Notes, Third Party Advisory
• https://patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-authenticated-idor-vulnerability-leading-to-paypal-email-changeThird Party Advisory
• https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txtRelease Notes, Third Party Advisory
• https://patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-authenticated-idor-vulnerability-leading-to-paypal-email-changeThird Party Advisory

Published

Aug 5, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36279A stack-based buffer overflow vulnerability exists in the ht…8.8
• CVE-2022-3628A buffer overflow flaw was found in the Linux kernel Broadco…6.6
• CVE-2022-36280An out-of-bounds(OOB) memory access vulnerability was found …5.5
• CVE-2022-36281Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-36282Authenticated (editor+) Stored Cross-Site Scripting (XSS) vu…5.4
• CVE-2022-36283Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-36285Authenticated Arbitrary File Upload vulnerability in dmitryl…7.2
• CVE-2022-36286Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-36287Uncaught exception in the FCS Server software maintained by …4.3
• CVE-2022-36288Multiple Cross-Site Request Forgery (CSRF) vulnerabilities i…8.8
• CVE-2022-36289Protection mechanism failure in the Intel(R) Media SDK softw…5.5
• CVE-2022-3629A vulnerability was found in Linux Kernel. It has been decla…3.3