CVE-2026-65558

MediumCVSS 5.4

Published: 27/07/2026(UTC)Updated: 27/07/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Summary

The AffiliateX plugin version 2.3.5 and earlier has a Server-Side Request Forgery (SSRF) vulnerability without authentication. An unauthenticated attacker can send requests to internal resources.

Risk Assessment

The risk includes scanning internal networks, accessing internal services, or using the server to attack other systems.

Recommendation

Update AffiliateX to a version above 2.3.5 that includes a fix restricting outgoing requests.

Other vulnerabilities in AffiliateX

CVE-2025-69346Medium
The AffiliateX plugin for WordPress (versions up to and including 1.3.9.3) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured authorization mechanisms.

Original NVD description (English source)

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS