SQL Injection Vulnerability in AffiliateWP Plugin for WordPress

CVE-2025-8877

What is CVE-2025-8877?

The AffiliateWP plugin for WordPress suffers from a SQL Injection vulnerability due to inadequate input validation on user-supplied parameters within the ajax_get_affiliate_id_from_login function. This flaw exists in all versions up to and including 2.28.2. It allows unauthenticated attackers to manipulate existing SQL queries, potentially gaining access to sensitive database information through additional query injection. Website owners should take immediate action to update the plugin to mitigate the risk associated with this vulnerability.

References