LWS Affiliation

LWS Affiliation has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high.

The most common weakness is Missing Authorization, behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), PHP Remote File Inclusion.

3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

3 independent researchers contributed these findings, one record each. LWS Affiliation is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage75%

Open

Fixed

Get automatic notifications for all LWS Affiliation vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-57934

LWS Affiliation <= 2.3.6 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

4 records


2025-09-22 00:00	LWS Affiliation <= 2.3.6 - Cross-Site Request Forgery LWS Affiliation <= 2.3.6	`CVE-2025-57934`	4.3 Medium	Nabil Irawan	No
2024-08-26 00:00	LWS Affiliation <= 2.3.4 - Missing Authorization LWS Affiliation <= 2.3.4	`CVE-2024-43962`	4.3 Medium	Fariq Fadillah Gusti Insani (fariqfgi)	Yes
2023-07-24 00:00	LWS Affiliation <= 2.2.6 - Unauthenticated Remote/Local File Inclusion LWS Affiliation <= 2.2.6	`CVE-2023-32297`	9.8 Critical	Marco Wotschka	Yes
2022-12-12 00:00	LWS Plugins <= (Various Versions) - Missing Authorization Checks LWS Affiliation <= 2.1	`N/A`	8.8 High	Anonymous	Yes

Showing 1–4 of 4 reports

Latestv2.3.6

LWS Affiliation

Author

Aurélien LWS

5.0(2)

100/100

Last Updated

2025-02-25 (2y ago)

Active Installs

700+

Downloads

49,845

Requires WP

5.0+

Requires PHP

7.0+

Tested up to

WP 6.7.7

Created

2022-08-23 (4y ago)

This plugin, created by LWS, allows you to easily add banners and widgets such as domain name availability search or a summary table of our hosting plans on your website. Enjoy our affiliate program and earn money! Key Features Major features in LWS Affiliation include: Add an affiliate banner in one click. Add a customizable domain name search widget. Add a table of our hosting offers (shared hosting, VPS, e-commerce, cloud, etc…). Follow the perfomances of your widgets on your website You will need a LWS Affiliation account to use it. This plugin is ideal for fans of LWS services and especially Best Sellers shared web hosting , WordPress hosting, cPanel hosting.

View on WordPress.org