CVE-2022-3898

The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on various functions including the affiliates_menu method. This makes it possible for unauthenticated attackers to delete affiliate records, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://www.tipsandtricks-hq.com/wordpress-affiliate-platform-plugin-simple-affiliate-program-for-wordpress-blogsite-1474Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a6096b9a-f7bb-454a-8203-50ac99d37100?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3898Third Party Advisory
• https://www.tipsandtricks-hq.com/wordpress-affiliate-platform-plugin-simple-affiliate-program-for-wordpress-blogsite-1474Product
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3898Third Party Advisory

Published

Nov 29, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38973Improper access control for some Intel(R) Arc(TM) graphics c…7.1
• CVE-2022-38974Broken Access Control vulnerability in WPML Multilingual CMS…4.3
• CVE-2022-38975DOM-based cross-site scripting vulnerability in EC-CUBE 4 se…5.4
• CVE-2022-38977The HwAirlink module has a heap overflow vulnerability.Succe…7.5
• CVE-2022-38978The secure OS module has configuration defects. Successful e…7.5
• CVE-2022-38979The secure OS module has configuration defects. Successful e…7.5
• CVE-2022-38980The HwAirlink module has a heap overflow vulnerability in pr…9.8
• CVE-2022-38981The HwAirlink module has an out-of-bounds read vulnerability…7.5
• CVE-2022-38982The fingerprint module has service logic errors.Successful e…9.8
• CVE-2022-38983The BT Hfp Client module has a Use-After-Free (UAF) vulnerab…9.8
• CVE-2022-38984The HIPP module has a vulnerability of not verifying the dat…7.5
• CVE-2022-38985The facial recognition module has a vulnerability in input v…7.5