CVE-2025-13859
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| affiliatex | amazon_affiliate_plugin | From 1.0.0 (inc) to 1.3.9.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the AffiliateX – Amazon Affiliate Plugin for WordPress allows authenticated users with Subscriber-level access or higher to modify data without proper authorization. This is due to a missing capability check on the save_customization_settings AJAX action, enabling these users to store arbitrary JavaScript that executes whenever an AffiliateX block renders on the site. This can lead to Cross-Site Scripting (XSS) attacks by injecting malicious scripts. [1, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers with low-level access (Subscriber or above) to inject and execute arbitrary JavaScript on your website. This can lead to unauthorized actions such as stealing user data, hijacking user sessions, defacing the site, or delivering malware to visitors. It compromises the integrity and security of your website and its users. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress site is running the AffiliateX – Amazon Affiliate Plugin versions 1.0.0 to 1.3.9.3. Additionally, you can look for unauthorized JavaScript injections in the AffiliateX blocks on your site. There are no specific network commands provided in the resources, but you can inspect AJAX requests to the save_customization_settings action for missing nonce or capability checks. For example, you might use browser developer tools or curl to check if the AJAX endpoint accepts requests without proper authorization. Example command to test AJAX endpoint (replace URL and parameters accordingly): curl -X POST -d "action=save_customization_settings&security=invalid_nonce" https://your-site.com/wp-admin/admin-ajax.php -v [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the AffiliateX plugin to a version that includes the security fixes (post 1.3.9.3) which add nonce verification and capability checks to AJAX actions. This prevents unauthorized users from modifying data. If updating is not immediately possible, restrict access to the AJAX endpoints and ensure only trusted users have Subscriber-level or higher access. Monitoring and sanitizing inputs to prevent arbitrary JavaScript injection is also recommended. [1, 3]