CVE-2026-110179

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...

CVE-2026-110179

The affiliate-toolkit WordPress plugin (versions before 3.8.9 ) is vulnerable to SQL injection because it fails to validate user-supplied sort values against an allowlist before including them in database queries. This flaw is reachable via an administrative list screen that only requires editor-...

CVE-2026-110179 affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...

WordPress affiliate-toolkit plugin < 3.8.9 - Editor+ SQL Injection vulnerability

Editor+ SQL Injection vulnerability discovered by Pedro Pinho in WordPress Plugin affiliate-toolkit versions 3.8.9...

EUVD-2026-102697

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...

CVE-2026-110179: Improper Neutralization of Special Elements used in an SQL Command

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...

PT-2026-115477

Name of the Vulnerable Software and Affected Versions affiliate-toolkit WordPress plugin versions prior to 3.8.9 Description The plugin fails to validate a user-supplied sort value against an allowlist before incorporating it into a database query. Because the affected administrative list screen...

WordPress affiliate-toolkit plugin < 3.9.1 - Contributor+ RCE vulnerability

Contributor+ RCE vulnerability discovered by Artus KG in WordPress Plugin affiliate-toolkit versions 3.9.1...

CVE-2026-86787

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

EUVD-2026-100853

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

CVE-2026-86787 Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

CVE-2026-86787

The affiliate-toolkit WordPress plugin, versions 3.8.7 through 3.9.0 , is vulnerable to Remote Code Execution (RCE) . The root cause is that the plugin's bundled templating engine fails to prevent low-privileged users from providing a template body containing a BladeOne @php Directive . This allo...

PT-2026-113681

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

CVE-2026-86787: Improper Control of Generation of Code

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

CVE-2026-42721

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

EUVD-2026-94262

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

CVE-2026-42721

The SERVIT Software Solutions affiliate-toolkit (affiliate-toolkit-starter) plugin for WordPress is vulnerable to Blind SQL Injection in versions n/a through 3.9.1 . This issue stems from the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). An attacker with high privil...

CVE-2026-42721 WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

CVE-2026-42721 WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin affiliate-toolkit versions = 3.9.1...