CVE-2026-110179
affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
| Vendor | unknown |
| Product | affiliate-toolkit |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown affiliate-toolkit
Be the first to know when new unknown vulnerabilities affecting unknown affiliate-toolkit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / affiliate-toolkit
0 < 3.8.9
References
Credits
Pedro Pinho WPScan