CVE-2026-52692: WordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerability

Synopsis

An unauthenticated sensitive data exposure vulnerability affects the Affiliates Manager WordPress plugin at version 2.9.50 and below. The vulnerability is reachable over the network with no authentication required, meaning any external actor who can send HTTP requests to a site running the plugin can trigger the exposure. Successful exploitation allows an attacker to read sensitive data from the affected WordPress installation. No fix version has been published; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access is needed, making any internet-exposed site a viable target.

• AuthenticationNot required

  No account or session token is needed; the attacker can trigger the exposure as an anonymous HTTP client.

• Victim interactionNot required

  No user action is required; the attacker can exploit the vulnerability entirely on their own without involving a logged-in user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• An unauthenticated attacker reads sensitive data exposed by the plugin, which may include affiliate account details, commission records, or other business-sensitive information stored by the plugin.
• Exposed data can be harvested at scale with no account creation or prior reconnaissance, lowering the bar for mass-scanning attacks against sites running the plugin.
• Confidentiality of affiliate partner data is fully compromised; integrity and availability of the service are not directly affected by this vulnerability.