FluentAffiliate <= 1.6.5 - Unauthenticated Affiliate Profile Creation for Arbitrary Users via Paymattic Affiliate Registration Integration

ID

WPSEC-2026-2056

Plugin

FluentAffiliate – Affiliate Program Management Suite, Affiliates Manager (fluent-affiliate)

Affected

all versions before 1.7.0

Remediation

Update to 1.7.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-639

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30

Attack surface

FluentAffiliate on WPSec AttackSurface

Fix released

2026-10-29

Published

2026-10-30

Description

The FluentAffiliate plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the Paymattic affiliate registration integration in all versions up to, and including, 1.6.5, due to the integration binding a logged-out form submission to whichever existing WordPress account matches the submitted, unverified email address. This makes it possible for unauthenticated attackers to create an affiliate profile tied to another user's account, including an administrator's, with a payment email they control, on sites where a Paymattic form uses the FluentAffiliate registration feed.

References

• https://wpsec.com/vuln/WPSEC-2026-2056/
• https://plugins.svn.wordpress.org/fluent-affiliate/tags/1.7.0/
• https://wordpress.org/plugins/fluent-affiliate/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS