CVE-2026-110179

Name of the Vulnerable Software and Affected Versions affiliate-toolkit WordPress plugin versions prior to 3.8.9

Description The plugin fails to validate a user-supplied sort value against an allowlist before incorporating it into a database query. Because the affected administrative list screen requires only lower-privilege capabilities instead of administrator rights, users with editor-level access or higher can execute SQL injection to read arbitrary information from the database. In multisite environments, a sub-site editor can access the network-global users table, which may include the password hash of the super administrator.

Recommendations Update affiliate-toolkit WordPress plugin to version 3.8.9 or later.