CVE-2021-24844: Affiliate Manager < 2.8.7 - Admin+ SQL injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-08 · updated 2026-06-17
Weakness: CWE-89

Description

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue

Affected products

Affiliates Manager: before 2.8.7 — fixed in 2.8.7

How to fix

Upgrade to a fixed version: Affiliates Manager 2.8.7. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2611862/
https://wpscan.com/vulnerability/ebd6d13c-572e-4861-b7d1-a7a87332ce0d
https://plugins.trac.wordpress.org/changeset/2611862/
https://wpscan.com/vulnerability/ebd6d13c-572e-4861-b7d1-a7a87332ce0d

Get alerted when CVE-2021-24844 or the next vulnerability affects your stack