CVE-2024-12561

The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This is due to insufficient validation on the redirect url supplied via the 'afflink' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.

• CWE-601

• https://plugins.trac.wordpress.org/browser/wecantrack/trunk/WecantrackApp.php#L66
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3320552%40wecantrack&new=3320552%40wecantrack&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b205ab-f042-46d9-a331-f18809477384?source=cve

Published

May 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12556Prototype Pollution in Kibana can lead to code injection via…9.8
• CVE-2024-12557The Transporters.io plugin for WordPress is vulnerable to Cr…6.1
• CVE-2024-12558The WP BASE Booking of Appointments, Services and Events plu…6.5
• CVE-2024-12559The ClickDesigns plugin for WordPress is vulnerable to unaut…5.3
• CVE-2024-1256A vulnerability was found in Jspxcms 10.2.0 and classified a…4.3
• CVE-2024-12560The Button Block – Get fully customizable & multi-functional…6.5
• CVE-2024-12562The s2Member Pro plugin for WordPress is vulnerable to PHP O…9.8
• CVE-2024-12563The s2Member Pro plugin for WordPress is vulnerable to Local…8.8
• CVE-2024-12564Exposure of Sensitive Information to an Unauthorized Actor v…6.9
• CVE-2024-12566The Email Subscribers by Icegram Express WordPress plugin b…4.8
• CVE-2024-12567The Email Subscribers by Icegram Express WordPress plugin b…4.8
• CVE-2024-12568The Email Subscribers by Icegram Express WordPress plugin b…4.8