Unauthenticated SQL Injection occurs in the Affiliates Manager plugin in WordPress for all versions up to 2.9.53. The flaw allows an attacker to construct arbitrary SQL queries that are executed by the database layer, potentially exposing sensitive data or allowing modification of the database. This injection is not limited to read‑only operations; phrases such as "unauthenticated" imply that no user credentials are required and the attacker can easily exploit the vulnerability via crafted requests. The weakness is recognized as CWE‑89, which confirms that the root of the problem is improper handling of SQL input.

The vulnerability affects the WordPress Affiliates Manager plugin, listed under the vendor wp.insider:Affiliates Manager. Only releases up to and including version 2.9.53 are susceptible; newer versions (2.9.54 and later) contain the fix. Sites running WordPress with this plugin installed before the critical update are exposed.

The CVSS score of 9.3 indicates a high severity exploit that can lead to total database compromise. The EPSS score is not available, but the lack of authentication requirement raises the likelihood of exploitation, especially on publicly reachable sites. The issue is not currently listed in the CISA KEV catalog, yet its high publication visibility and impact warrant immediate attention. Attackers would likely inject SQL through the plugin’s input handling paths, needing no special credentials. Once exploited, they could exfiltrate data, insert malicious SQL statements, or alter database contents.