CVE-2026-86787

Name of the Vulnerable Software and Affected Versions affiliate-toolkit versions prior to 3.9.1

Description The plugin fails to prevent low-privileged users from providing a template body that the bundled templating engine compiles and executes as PHP. This occurs due to insufficient validation of user-supplied input, allowing authenticated attackers with the Contributor role or higher to perform Remote Code Execution (RCE), which is the ability to run arbitrary code on the server.

Recommendations Update to version 3.9.1 or later.