PT-2025-39962 · WordPress · Affiliatewp

Liontree · Published 2025-09-30 · Updated 2025-10-05 · CVE-2025-8877

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AffiliateWP plugin for WordPress versions up to and including 2.28.2

Description The AffiliateWP plugin for WordPress is susceptible to SQL Injection through the ajax get affiliate id from login function. This is due to inadequate escaping of user-supplied input and insufficient preparation of the existing SQL query. This allows unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database. The vulnerable parameter is not explicitly specified.

Recommendations Update the AffiliateWP plugin to a version later than 2.28.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-8877

Affected Products

Affiliatewp

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-8877 · Security Note
• https://affiliatewp.com · Note
• https://twitter.com/CVEnew/status/1972946769823875268 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5ae32a38-5be3-47d0-9c56-2fcda7662c71?source=cve · Note
• https://t.me/CVEtracker/33715 · Telegram Post
• https://reddit.com/r/HostingReport/comments/1nvk4xv/wordpress_affiliate_plugin_affiliatewp_is · Reddit Post
• https://twitter.com/cracbot/status/1974791725018149057 · Twitter Post