Affiliates Manager EUVD-2026-36899

The target WordPress site must have the wp.insider Affiliates Manager plugin installed and activated at version 2.9.50 or earlier, and the site must be reachable over the network - typical of any public WordPress deployment. No authentication, no user interaction, and no non-default configuration is required per the CVSS vector (PR:N/UI:N/AC:L), so any internet-exposed site running the affected plugin is in scope. Limiting factors: the description does not specify which exact endpoint or data fields are exposed, so exploitation depends on knowing or reverse-engineering the vulnerable route (trivial once the patched diff or Patchstack advisory details are public); sites that have disabled the affected plugin feature or restricted /wp-admin/admin-ajax.php and /wp-json/ at the edge are not exploitable.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) marks this as network-reachable, low-complexity, and fully unauthenticated with high confidentiality impact - a profile that makes mass scanning straightforward against any internet-exposed WordPress site running the plugin. No EPSS score, KEV listing, or POC was provided, so exploitation likelihood cannot be quantified from the supplied data, but Patchstack-disclosed WordPress plugin flaws of this class are commonly weaponized by automated scanners within weeks of disclosure. Conflicting/missing signals to note explicitly: the description says 'Sensitive Data Exposure' without naming which data is leaked (affiliate PII? payout details? API keys?), and the lower-bound affected version is not specified - only the upper bound '<= 2.9.50.' Treat as a real priority for any site running this plugin, but the absence of POC and KEV data means urgency is driven by the unauthenticated-network-C:H profile, not confirmed exploitation.

An attacker scans the internet for WordPress sites running Affiliates Manager <= 2.9.50, then issues unauthenticated HTTP requests to a vulnerable plugin endpoint (likely an admin-ajax action or REST route) that returns sensitive affiliate data such as account details, PII, referral statistics, or payout information. The attacker harvests this data at scale across many sites and uses it for follow-on fraud, phishing of affiliates, or sale on data-broker markets - no user interaction or credentials required given the AV:N/AC:L/PR:N/UI:N vector.