CVE-2026-7559 is a missing authorization vulnerability (CWE-862) in the Affilia – Affiliate Program & Referral Tracking for WooCommerce & WordPress plugin. The plugin fails to properly verify user authorization before allowing sensitive actions. The nonce used for authentication is embedded in every frontend page load and accessible to any authenticated user regardless of role. This allows attackers with subscriber-level access or higher to manipulate affiliate referrals and commissions, potentially leading to financial fraud. The vulnerability affects all versions up to and including 3.3.3. No official remediation or patch information is currently available.

The vulnerability allows authenticated users with low-level privileges to perform unauthorized actions such as approving or rejecting affiliate referrals, crediting commissions to affiliate wallets, deleting referral records, and modifying custom banner plugin options. This can lead to financial fraud and unauthorized manipulation of affiliate program data. There is no indication of confidentiality or availability impact. The CVSS score is 4.3 (medium severity), reflecting limited impact on confidentiality but significant integrity concerns.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity related to affiliate referral approvals and commission credits. Avoid granting subscriber-level access to untrusted users. Review plugin updates regularly for a security patch.