The SliceWP Affiliates plugin is vulnerable to a generic SQL injection that occurs via the 'email' parameter. Any user can append malicious SQL to the existing query when they register through WooCommerce. This flaw allows them to read, modify or delete data from the database, exposing confidential business and user information. The weakness is a classic injection flaw identified as CWE-89.

WordPress sites running the Affiliate Program Suite – SliceWP Affiliates plugin through version 1.2.14 or earlier are affected. The plugin is developed by iovamihai and is used as a WordPress extension to manage affiliate registrations.

The CVSS score of 7.5 reflect a high severity attack that is unauthenticated and may be executed remotely without special privileges. EPSS data is not available, but the absence of a KEV listing does not reduce the risk, as the flaw can be exploited via a public registration form. In practice, the vulnerable code path is triggered by the WooCommerce user_register hook, which requires only a guest-obtainable nonce. Attackers can therefore reach the vulnerable code without logging in, making the exploitation straightforward for automated scanners and malicious actors.