SQL Injection Vulnerability in Multi-Network Affiliate & Amazon Product Display Plugin for WordPress
CVE-2026-12743

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Affiliate-toolkit – Multi-network Affiliate & Amazon Product Display
Vendor
CVE Published:
14 August 2026

What is CVE-2026-12743?

The Multi-Network Affiliate & Amazon Product Display plugin for WordPress has a vulnerability that allows time-based SQL Injection through the 'orderby' parameter. This issue affects all versions up to and including 3.8.8, arising from inadequate escaping of user input and poor query preparation. Authenticated users with administrator privileges can exploit this flaw to inject additional SQL queries into existing ones, potentially gaining access to sensitive database information.

Affected Version(s)

affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display 0 <= 3.8.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/affiliate-tool...
https://plugins.trac.wordpress.org/browser/affiliate-tool...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.