CVE-2026-7559 is a missing authorization vulnerability (CWE-862) in the Affilia plugin for WordPress and WooCommerce, affecting all versions up to 3.3.3. The plugin fails to verify that a user is authorized to perform sensitive actions such as approving or rejecting affiliate referrals, crediting commissions, deleting referral records, and modifying plugin options. The nonce used for authentication is embedded in every frontend page load and accessible to any authenticated user regardless of role, enabling privilege escalation to perform unauthorized actions.

An attacker with subscriber-level or higher authenticated access can manipulate affiliate referral approvals, credit commissions fraudulently, delete referral data, and alter plugin settings. This can lead to financial fraud and unauthorized modification of affiliate program data. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles and monitor for suspicious affiliate activity. Avoid granting subscriber or higher access to untrusted users.