{"id":"CVE-2026-39789","published":"2026-10-06T06:17:01.227","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluent-affiliate-pro/vulnerability/wordpress-fluent-affiliate-pro-plugin-1-6-4-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Fluent Affiliate Pro plugin allows unauthenticated users to perform actions that should require authentication, leading to potential unauthorized modifications of affiliate settings and data. This broken access control vulnerability could allow attackers to manipulate affiliate configurations without needing valid credentials.","exploitability":"Exploitation is straightforward with no prerequisites needed since the vulnerability affects unauthenticated requests, requiring only network access to the affected WordPress site.","blast_radius":"The impact could be significant across all Fluent Affiliate Pro installations up to version 1.6.4, potentially affecting affiliate marketing campaigns, commission structures, and related data integrity.","remediation":"Upgrade to Fluent Affiliate Pro version 1.6.5 or later to remediate this broken access control vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","wordpress","plugin","affiliation"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:01:45.606Z"}}