CVE-2026-86787
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from…
- Risk score
- 50/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
- Affected
- See advisory
- Fix
- Upgrade the product to 3.9.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
Original description
The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.
Last activity 14 Oct 2026. Patch Forecast updates every hour.