CVE-2024-0859

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the process_bulk_action function in ListAffiliatesTable.php. This makes it possible for unauthenticated attackers to delete affiliates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/browser/affiliates-manager/trunk/classes/ListAffiliatesTable.phpProduct
• https://plugins.trac.wordpress.org/changeset/3028484/affiliates-manager/trunk?contextall=1&old=3015278&old_path=%2Faffiliates-manager%2FtrunkPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/433a03c2-09fd-4ce6-843b-55ad09f4b4f7?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/affiliates-manager/trunk/classes/ListAffiliatesTable.phpProduct
• https://plugins.trac.wordpress.org/changeset/3028484/affiliates-manager/trunk?contextall=1&old=3015278&old_path=%2Faffiliates-manager%2FtrunkPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/433a03c2-09fd-4ce6-843b-55ad09f4b4f7?source=cveThird Party Advisory

Published

Feb 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0853curl inadvertently kept the SSL session ID for connections i…5.3
• CVE-2024-0854URL redirection to untrusted site ('Open Redirect') vulnerab…5.4
• CVE-2024-0855The Spiffy Calendar WordPress plugin before 4.9.9 doesn't ch…5.3
• CVE-2024-0856The Appointment Booking Calendar WordPress plugin before 1.3…8.8
• CVE-2024-0857Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2024-0858The Innovs HR WordPress plugin through 1.0.3.4 does not have…8.8
• CVE-2024-0860 The affected product is vulnerable to a cleartext transmiss…7.5
• CVE-2024-0861An issue has been discovered in GitLab EE affecting all vers…4.3
• CVE-2024-0862The Proofpoint Encryption endpoint of Proofpoint Enterprise …5
• CVE-2024-0864Enabling Simple Ajax Uploader plugin included in Laragon ope…9.8
• CVE-2024-0865CWE-798: Use of hard-coded credentials vulnerability exists …7.8
• CVE-2024-0866The Check & Log Email plugin for WordPress is vulnerable to …8.1