# FluentAffiliate <= 1.6.5 - Authenticated (Subscriber+) Missing Authorization to Affiliate Registration via 'fluent_affiliate_user_registration' AJAX Action

- **ID:** WPSEC-2026-2057
- **Plugin:** FluentAffiliate – Affiliate Program Management Suite, Affiliates Manager (`fluent-affiliate`), https://wordpress.org/plugins/fluent-affiliate/
- **Affected versions:** all versions before 1.7.0
- **Fixed in:** 1.7.0 (Update to 1.7.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fluent-affiliate
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2057/

## Description

The FluentAffiliate plugin for WordPress is vulnerable to unauthorized affiliate registration via the logged-in 'fluent_affiliate_user_registration' AJAX action (handleExistingUserRegistration) in all versions up to, and including, 1.6.5, due to the handler not checking whether affiliate registration is enabled before creating an affiliate profile. This makes it possible for authenticated attackers, with subscriber-level access and above, to register themselves as affiliates, with the site's initial affiliate status (active when auto-approval is on), even when the site owner has turned affiliate registration off.

## References

- https://wpsec.com/vuln/WPSEC-2026-2057/
- https://plugins.svn.wordpress.org/fluent-affiliate/tags/1.7.0/
- https://wordpress.org/plugins/fluent-affiliate/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2057/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.