Affiliates Manager EUVD-2026-60780

Exploitation requires only that a site have the Affiliates Manager plugin (≤ 2.9.53) installed and active with its affiliate-facing request handling reachable over the network; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or non-default configuration is needed, so default installations exposing the affiliate/registration endpoints are directly exploitable by unauthenticated remote attackers. Limiting factors: the site must actually have the vulnerable plugin installed and the specific vulnerable endpoint/parameter must be accessible (not blocked by a WAF, access control, or a disabled affiliate feature); if public affiliate functionality is disabled or the plugin is deactivated, the attack surface is removed.

Signals are largely consistent and point to a genuine priority for exposed sites: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N yields network, low-complexity, unauthenticated, no-user-interaction exploitation, and the scope change (S:C) plus C:H reflect meaningful cross-boundary data exposure. However, several confidence-limiting gaps exist: no EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified; there is no KEV listing and no evidence of a public POC, so this is currently a high-severity finding without confirmed exploitation. The supplied vector rates I:N and A:L, which is somewhat atypical for SQLi (many SQLi flaws carry integrity/availability impact); this suggests Patchstack assessed the injection as read/blind-oriented rather than allowing writes - treat integrity impact as unconfirmed rather than assuming full write capability. Overall this is a real, actionable high-priority issue for any internet-facing WordPress site running the plugin, not a paper-tiger high-CVSS finding, but exploitation is inferred-feasible rather than observed.

A remote attacker with no account crafts a malicious value in an affiliate-facing parameter (e.g., a referral or registration field) that is concatenated into a backend SQL query, then uses UNION-based or blind injection to read arbitrary tables. From there they exfiltrate wp_users password hashes, secret keys, and affiliate payout/PII data, potentially leading to admin account compromise. No public POC is currently identified, but the AV:N/AC:L/PR:N profile makes reliable automated exploitation straightforward once the vulnerable parameter is known.