title: ThirstyAffiliates < 3.10.5 - Subscriber+ unauthorized image upload + CSRF
description: The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: ThirstyAffiliates
versions:
status: affected, versionType: custom, version: 0, lessThan: 3.10.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}