CVE-2026-12743

Name of the Vulnerable Software and Affected Versions affiliate-toolkit versions prior to 3.8.9

Description The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress contains a time-based SQL Injection. This occurs because the plugin does not sufficiently escape the user-supplied orderby parameter and fails to properly prepare the existing SQL query. Authenticated attackers with administrator-level access or higher can append additional SQL queries to extract sensitive information from the database.

Recommendations Update affiliate-toolkit to a version newer than 3.8.8.