{
 "id": "WPSEC-2026-2057",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2057/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2057/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2057/index.md",
 "title": "FluentAffiliate <= 1.6.5 - Authenticated (Subscriber+) Missing Authorization to Affiliate Registration via 'fluent_affiliate_user_registration' AJAX Action",
 "description": "The FluentAffiliate plugin for WordPress is vulnerable to unauthorized affiliate registration via the logged-in 'fluent_affiliate_user_registration' AJAX action (handleExistingUserRegistration) in all versions up to, and including, 1.6.5, due to the handler not checking whether affiliate registration is enabled before creating an affiliate profile. This makes it possible for authenticated attackers, with subscriber-level access and above, to register themselves as affiliates, with the site's initial affiliate status (active when auto-approval is on), even when the site owner has turned affiliate registration off.",
 "plugin": {
  "slug": "fluent-affiliate",
  "name": "FluentAffiliate",
  "full_name": "FluentAffiliate – Affiliate Program Management Suite, Affiliates Manager",
  "wordpress_org": "https://wordpress.org/plugins/fluent-affiliate/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fluent-affiliate/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fluent-affiliate"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.7.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.7.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.7.0",
 "remediation": "Update to 1.7.0 or later.",
 "fix_released": "2026-10-29T12:00:53+00:00",
 "published": "2026-10-30T12:49:34+00:00",
 "updated": "2026-10-29T17:44:09.115757+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2057/",
  "https://plugins.svn.wordpress.org/fluent-affiliate/tags/1.7.0/",
  "https://wordpress.org/plugins/fluent-affiliate/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fluent-affiliate",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}