PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65558 WPCenter CVE debrief

A vulnerability was found in AffiliateX plugin version 2.3.5 or earlier. This vulnerability allows unauthenticated Server Side Request Forgery (SSRF). The CVSS score for this vulnerability is 5.4, and it is classified as MEDIUM severity. The vulnerability can potentially allow attackers to make unauthorized requests on behalf of the server, which could lead to various impacts including data breaches or further exploitation. Users of AffiliateX plugin version 2.3.5 or earlier should be aware of this vulnerability and take necessary actions to mitigate it.

Vendor
WPCenter
Product
AffiliateX
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Users of AffiliateX plugin version 2.3.5 or earlier should be aware of this vulnerability and take necessary actions to mitigate it. This includes administrators, security teams, and operators who manage or use the affected plugin. The vulnerability's impact could be significant if exploited, making it essential for those responsible for the plugin's maintenance to address it promptly.

Technical summary

The vulnerability is caused by an unauthenticated Server Side Request Forgery (SSRF) in AffiliateX plugin version 2.3.5 or earlier. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. This vulnerability could allow attackers to make unauthorized requests, potentially leading to data breaches or further exploitation. The vulnerability has a CVSS score of 5.4, indicating medium severity.

Defensive priority

Medium priority due to the CVSS score of 5.4 and the potential impact of SSRF attacks. Immediate action is recommended to mitigate the vulnerability.

Recommended defensive actions

  • Inventory and verify AffiliateX plugin versions
  • Apply patches or updates if available
  • Monitor for suspicious activity
  • Consider compensating controls
  • Review and implement additional security measures to prevent SSRF attacks

Evidence notes

The CVE record was published on 2026-07-27T15:17:09.210Z and was last modified on 2026-07-27T17:46:02.447Z. The NVD entry is currently Deferred. The vulnerability affects AffiliateX plugin version 2.3.5 or earlier, allowing unauthenticated Server Side Request Forgery (SSRF). Evidence is limited to CVE and NVD details.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-65558 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-65558

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-65558 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-65558

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.