The WC Affiliate – WooCommerce Affiliate Plugin suffers from a missing capability check in its 'export_all_data' function, which leads to unauthorized data exposure. Authenticated users with minimal privileges (Subscriber-level or above) can exploit this flaw to access sensitive affiliate information, including PII. This vulnerability is classified under CWE-862 (Missing Authorization). It affects all plugin versions up to and including 2.5.3. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity and low privileges required, resulting in high confidentiality impact but no integrity or availability impact. No patch or official fix has been documented in the provided data.

The vulnerability allows unauthorized access to sensitive affiliate data, including personally identifiable information, by authenticated users with Subscriber-level access or higher. This exposure can lead to privacy violations and potential misuse of affiliate data. There is no indication of impact on data integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only, minimizing Subscriber-level access. Monitor for updates from the plugin vendor and apply any official patches promptly once released.