Unauthenticated Server Side Request Forgery in AffiliateX by Patchstack
CVE-2026-65558

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Affiliatex
Vendor
CVE Published:
27 July 2026

What is CVE-2026-65558?

The AffiliateX WordPress plugin versions up to 2.3.5 are vulnerable to an unauthenticated Server Side Request Forgery (SSRF) attack. This vulnerability allows attackers to send crafted requests that can access sensitive data or internal services on the server, potentially leading to unauthorized actions and information disclosure. Websites using this plugin should upgrade to the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

AffiliateX <= 2.3.5

References

https://patchstack.com/database/wordpress/plugin/affiliat...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.