CVE-2022-36284: 
WordPress vulnerability analysis and mitigation

An authenticated Insecure Direct Object References (IDOR) vulnerability was discovered in StoreApps Affiliate For WooCommerce premium plugin versions 4.7.0 and below for WordPress. The vulnerability allows an attacker to change the PayPal email address (Patchstack).

The vulnerability has been assigned a CVSS score of 6.4, indicating a medium severity level. It is classified as an Insecure Direct Object References (IDOR) vulnerability, which falls under the OWASP Top 10 category of Broken Access Control. The vulnerability affects versions 4.7.0 and below of the Affiliate For WooCommerce premium plugin (Patchstack).

If exploited, this vulnerability could allow an authenticated attacker to bypass authorization and modify PayPal email addresses in the system. This could potentially lead to commission payments being redirected to unauthorized PayPal accounts (Patchstack).

The vulnerability requires authentication to exploit, which somewhat limits its potential for widespread abuse. However, once authenticated, an attacker could potentially exploit the IDOR vulnerability to manipulate PayPal email addresses (Patchstack).

The vulnerability has been patched in version 4.8.0 of the plugin. Users are strongly recommended to update to version 4.8.0 or later to resolve this security issue (Patchstack).