CVE-2026-57654 is a broken access control vulnerability in the wp.insider Affiliates Manager plugin affecting versions up to and including 2.9.49. The flaw arises from missing authorization checks, allowing users with limited privileges to perform unauthorized actions that can alter system integrity. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), indicating network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but high integrity impact. No official fix or patch is currently documented, and no known exploits have been reported.

The vulnerability allows an attacker with low privileges to perform unauthorized actions that can compromise the integrity of the Affiliates Manager system. There is no direct impact on confidentiality or availability. The integrity impact could allow modification or manipulation of affiliate data or related system functions, potentially leading to fraudulent or unauthorized affiliate activities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor vendor communications for updates. Until a fix is released, restrict access to trusted users and review user privileges carefully to minimize risk.