CVE-2026-39789

Summary

Fluent Affiliate Pro plugin allows unauthenticated users to perform actions that should require authentication, leading to potential unauthorized modifications of affiliate settings and data. This broken access control vulnerability could allow attackers to manipulate affiliate configurations without needing valid credentials.

Exploitability

Exploitation is straightforward with no prerequisites needed since the vulnerability affects unauthenticated requests, requiring only network access to the affected WordPress site.

Blast radius

The impact could be significant across all Fluent Affiliate Pro installations up to version 1.6.4, potentially affecting affiliate marketing campaigns, commission structures, and related data integrity.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Fluent Affiliate Pro version 1.6.5 or later to remediate this broken access control vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.