The vulnerability identified as CVE-2026-24592 in Lucian Apostol Auto Affiliate Links is classified as CWE-862, indicating missing authorization. This means the plugin does not properly enforce access control, allowing unauthorized users to perform actions that should be restricted. The issue affects all versions up to 6.8.8.3. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or official remediation level is currently documented.

Exploitation of this vulnerability could allow an attacker to perform unauthorized actions within the Auto Affiliate Links plugin, potentially modifying or injecting affiliate links without proper authorization. This impacts the integrity of the system but does not affect confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the plugin's administrative functions to trusted users only and monitor for unusual activity related to affiliate link management.