WordPress Plugin Vulnerabilities

AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking < 2.3.6 - Unauthenticated Server-Side Request Forgery

Description

The AffiliateX – Amazon Affiliate Plugin, Product Boxes, Comparison Tables & Affiliate Link Tracking plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.5. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
affiliatex
Fixed in 2.3.6

References

CVE
CVE-2026-65558
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0fe57abe-4354-46de-a742-d86722c381d8

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
c076336c-d1cb-4dc5-8eb0-d0cbe50749dc

Timeline

Publicly Published
2026-07-24 (about 1 month ago)
Added
2026-07-29 (about 1 month ago)
Last Updated
2026-07-29 (about 1 month ago)

Other

Published
Title
Published
2026-05-04
Title
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem < 3.6.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
Published
2023-02-10
Title
Shortcodes Ultimate < 5.12.7 - Subscriber+ SSRF
Published
2024-03-28
Title
Brave Popup Builder < 0.6.6 - Unauthenticated Server-Side Request Forgery
Published
2026-07-01
Title
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction < 3.0.5 - Unauthenticated Server-Side Request Forgery
Published
2024-04-24
Title
PDF Invoices & Packing Slips for WooCommerce < 3.8.1 - Unauthenticated Server-Side Request Forgery