Affiliates Manager CVE-2026-73358

No authentication is required - the vulnerability is confirmed exploitable by unauthenticated remote attackers (PR:N per CVSS vector and 'Unauthenticated' per CVE description). The attack requires active user interaction: a victim with an open browser session on the affected WordPress site must be socially engineered into loading the attacker-crafted URL (UI:R per CVSS). The site must have the Affiliates Manager plugin installed and active in version 2.9.53 or earlier. No non-default server configuration, special plugin settings, or specific WordPress version is indicated as a prerequisite. The primary limiting factor is mandatory victim interaction, which prevents fully automated, zero-click exploitation and requires a social engineering delivery stage.

The CVSS score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a network-exploitable, low-complexity attack requiring no privileges, constrained primarily by the need for victim interaction (UI:R). The scope change substantially elevates real-world impact: a successful lure that causes an authenticated WordPress admin to load a crafted URL grants script execution under the admin session, enabling account takeover, rogue plugin installation, or persistent backdoor placement. No EPSS score was provided in the source data, and neither a CISA KEV entry nor a public proof-of-concept has been identified, which moderates urgency relative to confirmed active exploitation. That said, even a mid-sized municipal IT team in walbrzych managing WordPress affiliate storefronts should treat this as a priority remediation, given that unauthenticated XSS in WordPress plugins is routinely chained in bulk-scanning exploit kits. The A:L metric in the reported CVSS vector is atypical for XSS and likely reflects indirect browser-side disruption; independently assessed, direct availability impact for a standard XSS is negligible.

An attacker crafts a URL targeting the vulnerable WordPress site with a malicious JavaScript payload embedded in a parameter processed by the Affiliates Manager plugin, then delivers it via a phishing email to a logged-in WordPress administrator. When the admin loads the link, the script executes under the admin's authenticated browser session, allowing the attacker to exfiltrate session cookies, create new administrator accounts, or install a malicious plugin - achieving persistent site compromise without ever authenticating directly.