CVE-2026-110179
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value…
- Risk score
- 45/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.8.9 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.
Last activity 16 Oct 2026. Patch Forecast updates every hour.