CVE-2026-2290 is a Server-Side Request Forgery vulnerability (CWE-918) in the Post Affiliate Pro WordPress plugin maintained by jurajsim. It affects all versions up to and including 1.28.0. Authenticated attackers with Administrator privileges can abuse this vulnerability to initiate arbitrary outbound HTTP requests from the server hosting the plugin and read the responses. This can potentially be used to access internal resources or external systems reachable from the server. The vulnerability was confirmed by successful interaction with an external Collaborator endpoint. The CVSS v3.1 base score is 3.8, reflecting low severity due to the requirement for high privileges and limited impact on confidentiality and integrity.

An attacker with Administrator-level access can leverage this SSRF vulnerability to make arbitrary outbound HTTP requests from the server and read response data. This may allow the attacker to interact with internal or external systems accessible from the server, potentially exposing sensitive information or enabling further attacks. However, the impact is limited by the requirement for administrator privileges and the low CVSS score. There is no indication of denial of service or code execution impact.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. In the meantime, restrict administrator access to trusted users only to reduce risk. Since this vulnerability requires administrator privileges, limiting such access is a key mitigation step. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.