The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin suffers from a missing capability check in the atkp_create_list() function in all versions up to 3.5.4. This missing authorization allows authenticated users with subscriber-level privileges or higher to perform unauthorized actions such as creating product lists. The vulnerability is tracked as CVE-2024-1851 and is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability allows authenticated users with minimal privileges (subscriber-level) to perform unauthorized actions, specifically creating product lists within the plugin. This could lead to unauthorized modification of plugin data, potentially affecting the integrity and availability of affiliate product listings. The confidentiality impact is limited but present. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals and limit subscriber-level access where possible. Monitor for updates from the plugin vendor or WordPress security channels to apply any forthcoming patches promptly.