LWS Affiliation
Avoid: vulnerability published 22 Sep 2025 still has no fix after 14 days.
Based on 3 of 5 areas
Capped at 39: a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 20 |
| Security | 35 |
| Support | No data |
| Reputation | No data |
Active signals
Open issues right now, with links to the source.
- CriticalSEC-2Vulnerability published 22 Sep 2025 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.6 Oct 2025Evidence
- WarningMNT-2Tested up to WordPress 6.7.11, 4 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence
- WarningMNT-1No release in 20 months (last release 25 Feb 2025). Plan a replacement if the plugin is important to your site.25 Feb 2026Evidence
History: 4 past vulnerabilities, 1 still unpatched in the current version. Patched issues are listed in the Security record, not here.
Quick answers
- Is LWS Affiliation still maintained?
- No. Last release 25 Feb 2025, over 1 year ago. 25 Feb 2025 · wordpress.org
- Who owns LWS Affiliation, and has it changed hands?
- No change recorded. Main committer aurelienlws since Aug 2022. 3 Nov 2026 · SVN log
- Was LWS Affiliation removed from wordpress.org?
- No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
- Is LWS Affiliation safe?
- No. 1 known vulnerability has no fix in the current version. 22 Sep 2025 · Wordfence Intelligence
- Is the latest LWS Affiliation update safe to install?
- No ownership change before 2.3.6. No one-star spike after it. 25 Feb 2025 · Release history
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| plugin-master | 22 Aug 2022 to 22 Aug 2022, 1 commits |
|---|---|
| aurelienlws | 23 Aug 2022 to 15 Dec 2025, 30 commits |
2 committers recorded. No ownership changes recorded since 2022.
Maintenance
- Last release
- 21 months ago
- Releases, 24 months
- 1
- Tested up to
- 6.7 vs 7.1
- Requires PHP
- 7.0 supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 1 |
| Q3 2024 | 2 |
| Q4 2024 | 0 |
| Q1 2025 | 1 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 0 |
| Q1 2026 | 0 |
| Q2 2026 | 0 |
| Q3 2026 | 0 |
| Q4 2026 | 0 |
Last release 25 Feb 2025. Tested up to 6.7, 4 major versions behind WordPress 7.1.
Support
- Resolved, last 2 months
- n/a
- Threads, last 2 months
- 0
Trend appears after 8 weekly snapshots.
Security record
1 vulnerability in 24 months (4 on record), 1 with no fix in the current version.
| Date | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 22 Sep 2025 | Cross-Site Request Forgery | 4.3 | <= 2.3.6 | No fix | n/a |
Show 3 patched vulnerabilities
| Date | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 26 Aug 2024 | Missing Authorization | 4.3 | <= 2.3.4 | 2.3.5 | n/a |
| 24 Jul 2023 | Unauthenticated Remote/Local File Inclusion | 9.8 | <= 2.2.6 | 2.3 | n/a |
| 12 Dec 2022 | LWS Plugins <= (Various Versions) - Missing Authorization Checks | 8.8 | <= 2.1 | 2.2 | n/a |
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Reputation
Last 90 days: no reviews. Lifetime: 5.0.
| Last 90 days | No reviews |
|---|---|
| Lifetime | 5.0 |
| 5 star | 2 |
|---|---|
| 4 star | 0 |
| 3 star | 0 |
| 2 star | 0 |
| 1 star | 0 |
Momentum
- Active installs
- 600+
Momentum history builds with each snapshot.
Facts
- Version
- 2.3.6
- Author
- Aurélien LWS
- Added
- 23 Aug 2022
- Last updated
- 25 Feb 2025
- Active installs
- 600+
- Requires WordPress
- 5.0
- Tested up to
- 6.7.11
- Requires PHP
- 7.0
- Category
- E-commerce & Shopping
- Tags
- LWS, Hosting, widgets, affiliation, affiliate program
Other plugins by this author: LWS Optimize, LWS Cleaner, LWS Hide Login, LWS Tools, LWSCache
Questions about LWS Affiliation
Is LWS Affiliation still maintained?
No. Last release 25 Feb 2025, over 1 year ago.
Who owns LWS Affiliation, and has it changed hands?
No change recorded. Main committer aurelienlws since Aug 2022.
Was LWS Affiliation removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026.
Is LWS Affiliation safe?
No. 1 known vulnerability has no fix in the current version.
Is the latest LWS Affiliation update safe to install?
No ownership change before 2.3.6. No one-star spike after it.