PT-2026-26831 · WordPress · Post Affiliate Pro
CVE-2026-2290
·
Publicado
2026-03-21
·
Atualizado
2026-03-21
CVSS v3.1
3.8
Baixa
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Post Affiliate Pro versions prior to 1.28.1
Description
The Post Affiliate Pro plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF). This allows authenticated attackers with Administrator-level access to initiate arbitrary outbound requests from the application and read the returned response content. Successful exploitation has been confirmed by receiving and observing response data from an external Collaborator endpoint.
Recommendations
Update Post Affiliate Pro to version 1.28.1 or later.
Correção
SSRF
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Post Affiliate Pro