SQL Injection Vulnerability in Affiliate Toolkit WordPress Plugin
CVE-2026-110179
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 16 October 2026
Badges
What is CVE-2026-110179?
The Affiliate Toolkit WordPress plugin, prior to version 3.8.9, has a critical flaw where user-inputted sort values are not validated against an allowlist prior to their use in database queries. This oversight undermines security, permitting users with editor-level access and higher to execute SQL injection attacks. Consequently, these users may manipulate queries to read sensitive information from the database. In a multisite configuration, a sub-site editor could access the network-global users table, compromising critical data such as the super administrator's password hash.
Affected Version(s)
affiliate-toolkit 0 < 3.8.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.