CVE-2022-0634: ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-25 · updated 2026-06-17
Weakness: CWE-352

Description

The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.

Affected products

ThirstyAffiliates: before 3.10.5 — fixed in 3.10.5

How to fix

Upgrade to a fixed version: ThirstyAffiliates 3.10.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-0634 or the next vulnerability affects your stack