EUVD-2026-60780
GHSA-m6xp-8r2q-w62h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) reading beyond the plugin's own tables justifies S:C and C:H; no confirmed write/integrity or availability impact, so I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
AnalysisAI
Unauthenticated SQL injection in the WordPress plugin Affiliates Manager (by wp.insider) through version 2.9.53 lets remote attackers inject crafted SQL through affiliate-facing input without any authentication (PR:N), enabling extraction of sensitive database contents such as user records, affiliate payout data, and WordPress secrets. The high CVSS base score of 9.3 is driven by network reach, low complexity, and a scope change (S:C) reflecting impact on the wider WordPress database beyond the plugin's own tables. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a site have the Affiliates Manager plugin (≤ 2.9.53) installed and active with its affiliate-facing request handling reachable over the network; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or non-default configuration is needed, so default installations exposing the affiliate/registration endpoints are directly exploitable by unauthenticated remote attackers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent and point to a genuine priority for exposed sites: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N yields network, low-complexity, unauthenticated, no-user-interaction exploitation, and the scope change (S:C) plus C:H reflect meaningful cross-boundary data exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with no account crafts a malicious value in an affiliate-facing parameter (e.g., a referral or registration field) that is concatenated into a backend SQL query, then uses UNION-based or blind injection to read arbitrary tables. From there they exfiltrate wp_users password hashes, secret keys, and affiliate payout/PII data, potentially leading to admin account compromise. … |
| Remediation | No vendor-released patch version is identified in the provided data, so confirm the fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/affiliates-manager/vulnerability/wordpress-affiliates-manager-plugin-2-9-53-sql-injection-vulnerability) and upgrade to the first release above 2.9.53 once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress instances running Affiliates Manager through version 2.9.53 and assess business criticality of affiliate functionality; if non-critical, disable or remove the plugin immediately to eliminate attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Affiliates Manager
View allThe Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could all
The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL s
Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager plugin <= 2.9.20 versio
The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could all
The affiliates-manager plugin before 2.6.6 for WordPress has CSRF. Rated high severity (CVSS 8.8), this vulnerability is
Unauthenticated sensitive data exposure in the Affiliates Manager WordPress plugin versions 2.9.50 and earlier allows re
Unauthenticated Cross-Site Scripting in the Affiliates Manager WordPress plugin (versions ≤2.9.53) allows remote attacke
The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today