This vulnerability (CVE-2026-73355) is an unauthenticated SQL Injection in the wp.insider Affiliates Manager plugin for WordPress, affecting versions up to 2.9.53. The flaw involves improper neutralization of special elements used in SQL commands (CWE-89), allowing remote attackers to inject SQL code without requiring authentication. The CVSS 3.1 score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No patch or official remediation level has been published as of the data provided.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database due to high confidentiality impact. The vulnerability does not affect data integrity but may cause limited availability issues. Since the attack requires no authentication and can be performed remotely, the risk is critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the affected plugin or restricting access to it to mitigate risk.