Arbitrary Code Execution Vulnerability in Affiliate-Toolkit WordPress Plugin
CVE-2026-86787
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 14 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-86787?
The Affiliate-Toolkit WordPress plugin, prior to version 3.9.1, exposes a significant vulnerability that allows users with low privileges to manipulate the template body. When processed by the plugin's templating engine, this can result in arbitrary PHP code execution on the server. This poses a substantial security risk, as it enables unauthorized users with a Contributor role or higher to run malicious code, potentially leading to server compromise and data breaches.
Affected Version(s)
affiliate-toolkit 3.8.7 < 3.9.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.