CVE-2026-110179
UnknownSummary
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
Risk Assessment
An attacker with editor privileges can perform SQL injection and access sensitive data, including user password hashes, potentially leading to full system compromise.
Recommendation
Update the affiliate-toolkit plugin to version 3.8.9 or later.
Other vulnerabilities in affiliate-toolkit WordPress plugin
See all- CVE-2026-86787High
The affiliate-toolkit WordPress plugin before version 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
- CVE-2026-12743Medium
The affiliate-toolkit plugin for WordPress, up to and including version 3.8.8, is vulnerable to time-based SQL Injection via the 'orderby' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.
Original NVD description (English source)
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS