CVE-2026-120043

Name of the Vulnerable Software and Affected Versions SliceWP Affiliates versions prior to 1.2.15

Description An issue exists where unauthenticated attackers can perform a generic SQL Injection, a technique used to interfere with the queries that an application makes to its database. This occurs due to insufficient escaping of user-supplied data and lack of preparation in the SQL query. The flaw is triggered via the user register hook during WooCommerce My Account registration, allowing attackers to append malicious queries to extract sensitive information from the database using the email parameter.

Recommendations Update to a version newer than 1.2.14. Avoid using the email parameter during registration processes until the update is applied.