This vulnerability (CVE-2026-65558) is classified as CWE-918 (Server-Side Request Forgery) and affects unauthenticated users of AffiliateX plugin versions up to 2.3.5. An attacker can exploit this flaw to cause the server to send crafted HTTP requests to internal or external systems, potentially leading to information disclosure or indirect impacts on confidentiality and integrity. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change. No vendor advisory or patch information is currently available.

The vulnerability allows unauthenticated attackers to perform SSRF attacks, which may lead to limited confidentiality and integrity impacts by making the server send requests to arbitrary locations. There is no impact on availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access from the affected server to sensitive internal resources and monitor for unusual outbound requests related to AffiliateX. Avoid exposing the vulnerable plugin to untrusted users if possible.