FluentAffiliate <= 1.6.5 - Authenticated (Subscriber+) Missing Authorization to Affiliate Registration via 'fluent_affiliate_user_registration' AJAX Action

ID

WPSEC-2026-2057

Plugin

FluentAffiliate – Affiliate Program Management Suite, Affiliates Manager (fluent-affiliate)

Affected

all versions before 1.7.0

Remediation

Update to 1.7.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness

CWE-862

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30

Attack surface

FluentAffiliate on WPSec AttackSurface

Fix released

2026-10-29

Published

2026-10-30

Description

The FluentAffiliate plugin for WordPress is vulnerable to unauthorized affiliate registration via the logged-in 'fluent_affiliate_user_registration' AJAX action (handleExistingUserRegistration) in all versions up to, and including, 1.6.5, due to the handler not checking whether affiliate registration is enabled before creating an affiliate profile. This makes it possible for authenticated attackers, with subscriber-level access and above, to register themselves as affiliates, with the site's initial affiliate status (active when auto-approval is on), even when the site owner has turned affiliate registration off.

References

• https://wpsec.com/vuln/WPSEC-2026-2057/
• https://plugins.svn.wordpress.org/fluent-affiliate/tags/1.7.0/
• https://wordpress.org/plugins/fluent-affiliate/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS