Skip to content
Sign in
7.2 High

CVE-2026-86787 The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template…

Description

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

Affected products and versions

Product Affected versions Fixed in
affiliate-toolkit 3.8 3.8.7 → < 3.9.1 3.9.1

Other CVEs of affiliate-toolkit

The 3 CVEs of affiliate-toolkit →
CVE-2026-110179 The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist… 6.8 Medium CVE-2023-5877 The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's… 9.8 Critical
Track this CVE