The vulnerability exists in the AffiliateWP WordPress plugin, specifically in the ajax_get_affiliate_id_from_login function. Improper input sanitization and lack of prepared statements allow an attacker to append arbitrary SQL to existing queries. This can result in the extraction of sensitive database records, effectively exposing confidential data and compromising the confidentiality component of security. The weakness is classified as CWE-89.

All WordPress sites running AffiliateWP plugin version 2.28.2 or earlier are affected. The official CNA lists the product as AffiliateWP:AffiliateWP; no further version pinning is provided beyond the upper bound of 2.28.2.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that active exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it from any external point without authentication by sending crafted AJAX requests to the vulnerable endpoint. Successful exploitation permits data extraction only, but at multiple database levels due to the lack of query preparation.