Description
WordPress Plugin Affiliates Manager is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin Affiliates Manager version 2.8.6 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.8.7 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:EBD6D13C-572E-4861-B7D1-A7A87332CE0D
https://plugins.svn.wordpress.org/affiliates-manager/trunk/readme.txt
Related Vulnerabilities
Sqlite Integer Overflow or Wraparound Vulnerability (CVE-2018-20346)
Oracle Application Server CVE-2007-0280 Vulnerability (CVE-2007-0280)
WordPress Plugin Social Like Box and Page by WpDevArt Cross-Site Scripting (0.8.40)
Drupal Core 6.x Session Hijacking (6.0 - 6.33)
Coppermine Multiple Cross-site Scripting (XSS) Vulnerabilities (CVE-2015-6528)