CVE-2026-73355
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Unauthenticated SQL Injection vulnerability in Affiliates Manager plugin versions up to 2.9.53. An attacker without authentication can inject SQL queries.
Risk Assessment
Potential unauthorized access to the database, data leakage or modification.
Recommendation
Update the Affiliates Manager plugin to a version newer than 2.9.53.
Other vulnerabilities in Affiliates Manager
See all- CVE-2026-73358High
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager versions up to 2.9.53.
- CVE-2026-57654Medium
The Affiliates Manager plugin version 2.9.49 and earlier suffers from a broken access control vulnerability for affiliates. This allows unauthorized users to perform actions they should not have permission to.
- CVE-2026-52692High
Versions of Affiliates Manager up to 2.9.50 have a vulnerability that allows unauthorized access to sensitive data.
Original NVD description (English source)
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS