CVE-2026-86787
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The affiliate-toolkit WordPress plugin before version 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
Risk Assessment
An attacker can execute arbitrary PHP code on the server, potentially leading to full site compromise, data theft, or backdoor installation.
Recommendation
Update the affiliate-toolkit plugin to version 3.9.1 or later, which includes the fix preventing PHP code execution from templates.
Other vulnerabilities in affiliate-toolkit WordPress plugin
See all- CVE-2026-110179Unknown
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
- CVE-2026-12743Medium
The affiliate-toolkit plugin for WordPress, up to and including version 3.8.8, is vulnerable to time-based SQL Injection via the 'orderby' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.
Original NVD description (English source)
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS