CVE-2022-36284

MEDIUM 6.5CVE-2022-36284 · Published 05/08/2022 · updated 17/06/2026

In short

CVE-2022-36284 is a MEDIUM (CVSS 6.5) vulnerability affecting affiliate for woocommerce (storeapps).
Chance of exploitation in the next 30 days (EPSS): 0.65%, higher than 51.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
affiliate for woocommerce storeapps	`≤ 4.7.0`	No fix yet

Description

Authenticated IDOR vulnerability in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress allows an attacker to change the PayPal email. WooCommerce PayPal Payments plugin (free) should be at least installed to get the extra input field on the user profile page.

References

dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt · Release Notes
patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-authenticated-idor-vulnerability-leading-to-paypal-email-change · Third Party Advisory

More vulnerabilities in affiliate for woocommerce

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free