CVE-2026-86787

The affiliate-toolkit WordPress plugin, versions 3.8.7 through 3.9.0 , is vulnerable to Remote Code Execution (RCE) . The root cause is that the plugin's bundled templating engine fails to prevent low-privileged users from providing a template body containing a BladeOne @php Directive . This allo...