CVE-2026-2290

The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to initiate arbitrary outbound requests from the application and read the returned response content. Successful exploitation was confirmed by receiving and observing response data from an external Collaborator endpoint.

• CWE-918

• https://plugins.trac.wordpress.org/browser/postaffiliatepro/tags/1.28.0/Base.class.php#L127
• https://plugins.trac.wordpress.org/browser/postaffiliatepro/trunk/Base.class.php#L127
• https://www.wordfence.com/threat-intel/vulnerabilities/id/369cd6ca-bb36-479e-b342-36d2ca778ce1?source=cve

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22893A command injection vulnerability has been reported to affec…7.2
• CVE-2026-22894A path traversal vulnerability has been reported to affect F…6.5
• CVE-2026-22895A cross-site scripting (XSS) vulnerability has been reported…4.8
• CVE-2026-22897A command injection vulnerability has been reported to affec…9.8
• CVE-2026-22898A missing authentication for critical function vulnerability…9.8
• CVE-2026-22899A NULL pointer dereference vulnerability has been reported t…6.5
• CVE-2026-22900A use of hard-coded credentials vulnerability has been repor…9.8
• CVE-2026-22901A command injection vulnerability has been reported to affec…9.8
• CVE-2026-22902A command injection vulnerability has been reported to affec…6.7
• CVE-2026-22903An unauthenticated remote attacker can send a crafted HTTP r…9.8
• CVE-2026-22904Improper length handling when parsing multiple cookie fields…9.8
• CVE-2026-22905An unauthenticated remote attacker can bypass authentication…7.5