PT-2025-6566 · WordPress · Affiliate Links
Lucio Sá
·
Published
2025-02-18
·
Updated
2025-03-03
·
CVE-2024-13556
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Affiliate Links: WordPress Plugin for Link Cloaking and Link Management versions up to, and including, 3.0.1
Description
The Affiliate Links plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input from a file export. This allows unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Recommendations
For Affiliate Links: WordPress Plugin for Link Cloaking and Link Management versions up to, and including, 3.0.1, consider disabling the plugin until a patch is available to prevent potential exploitation.
As a temporary workaround, restrict access to file exports to minimize the risk of unauthenticated attackers injecting PHP Objects.
Avoid using untrusted input from file exports in the plugin until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Authorization
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Affiliate Links