Server-Side Request Forgery in Post Affiliate Pro Plugin for WordPress

CVE-2026-2290

What is CVE-2026-2290?

The Post Affiliate Pro plugin for WordPress has a vulnerability that allows authenticated attackers with Administrator access to conduct Server-Side Request Forgery (SSRF) attacks. This issue enables these attackers to send arbitrary web requests from the application, potentially exposing sensitive data by reading the returned response. It affects all versions up to and including 1.28.0, and successful exploitation has been confirmed through receipt of response data from an external endpoint.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References