# FluentAffiliate <= 1.6.5 - Unauthenticated Affiliate Profile Creation for Arbitrary Users via Paymattic Affiliate Registration Integration

- **ID:** WPSEC-2026-2056
- **Plugin:** FluentAffiliate – Affiliate Program Management Suite, Affiliates Manager (`fluent-affiliate`), https://wordpress.org/plugins/fluent-affiliate/
- **Affected versions:** all versions before 1.7.0
- **Fixed in:** 1.7.0 (Update to 1.7.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-affiliate
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2056/

## Description

The FluentAffiliate plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key via the Paymattic affiliate registration integration in all versions up to, and including, 1.6.5, due to the integration binding a logged-out form submission to whichever existing WordPress account matches the submitted, unverified email address. This makes it possible for unauthenticated attackers to create an affiliate profile tied to another user's account, including an administrator's, with a payment email they control, on sites where a Paymattic form uses the FluentAffiliate registration feed.

## References

- https://wpsec.com/vuln/WPSEC-2026-2056/
- https://plugins.svn.wordpress.org/fluent-affiliate/tags/1.7.0/
- https://wordpress.org/plugins/fluent-affiliate/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2056/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.