The vulnerability is an unauthenticated SSRF in the AffiliateX WordPress plugin up to version 2.3.5. An attacker can instruct the plugin to issue arbitrary HTTP or HTTPS requests from the vulnerable server. This can expose internal resources, leak sensitive data, or facilitate further attacks such as port scanning or credential harvesting. The weakness is catalogued as CWE‑918 and carries a CVSS score of 5.4, indicating a moderate severity risk. Based on the description, it is inferred that the plugin lacks proper validation on the requested URL, allowing the attacker to target any address accessible from the server, including internal networks.

All WordPress sites that have the AffiliateX plugin installed with a version of 2.3.5 or earlier are affected. No other products are listed, and the vendor identifies the issue as specific to the AffiliateX plugin. Since the CNA list and description only mention AffiliateX, we infer no other products or plugins are impacted.

The flaw can be exploited by any user that can send a request to the vulnerable plugin, as no authentication is required. The attacker can target any URL, including those behind firewalls or private networks, to gather information or push data to external endpoints. The EPSS score of 0.00138 (<1%) indicates a low probability of exploitation, while the CVSS assessment indicates a moderate likelihood of impact. The vulnerability is not currently listed in CISA’s KEV catalog, but adherence to patching is recommended given the potential for internal exposure. Based on the description, it is inferred that the likely attack vector is generic HTTP requests to exposed plugin endpoints that do not enforce authentication, allowing the SSRF payload to be supplied as a URL parameter.