PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-65558 WPCenter CVE debrief

A vulnerability was found in AffiliateX plugin version 2.3.5 or earlier. This vulnerability allows unauthenticated Server Side Request Forgery (SSRF). The CVSS score for this vulnerability is 5.4, and it is classified as MEDIUM severity. The vulnerability can potentially allow attackers to make unauthorized requests on behalf of the server, which could lead to various impacts including data breaches or further exploitation. Users of AffiliateX plugin version 2.3.5 or earlier should be aware of this vulnerability and take necessary actions to mitigate it.

Vendor
WPCenter
Product
AffiliateX
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-27
Original CVE updated
2026-07-27
Advisory published
2026-07-27
Advisory updated
2026-07-27

Who should care

Users of AffiliateX plugin version 2.3.5 or earlier should be aware of this vulnerability and take necessary actions to mitigate it. This includes administrators, security teams, and operators who manage or use the affected plugin. The vulnerability's impact could be significant if exploited, making it essential for those responsible for the plugin's maintenance to address it promptly.

Technical summary

The vulnerability is caused by an unauthenticated Server Side Request Forgery (SSRF) in AffiliateX plugin version 2.3.5 or earlier. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. This vulnerability could allow attackers to make unauthorized requests, potentially leading to data breaches or further exploitation. The vulnerability has a CVSS score of 5.4, indicating medium severity.

Defensive priority

Medium priority due to the CVSS score of 5.4 and the potential impact of SSRF attacks. Immediate action is recommended to mitigate the vulnerability.

Recommended defensive actions

  • Inventory and verify AffiliateX plugin versions
  • Apply patches or updates if available
  • Monitor for suspicious activity
  • Consider compensating controls
  • Review and implement additional security measures to prevent SSRF attacks

Evidence notes

The CVE record was published on 2026-07-27T15:17:09.210Z and was last modified on 2026-07-27T17:46:02.447Z. The NVD entry is currently Deferred. The vulnerability affects AffiliateX plugin version 2.3.5 or earlier, allowing unauthenticated Server Side Request Forgery (SSRF). Evidence is limited to CVE and NVD details.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-27T15:17:09.210Z and has not been modified since then. The NVD entry is currently Deferred.