CVE-2026-86787

Deferred Deferred - Pending Action

Arbitrary PHP Code Execution in Affiliate Toolkit WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86787

EUVD

EUVD-2026-100853

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	affiliate-toolkit	3.8.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

The vulnerability in the Affiliate Toolkit WordPress plugin before version 3.9.1 allows low-privileged users like Contributors to supply a malicious template body that the plugin's templating engine compiles and executes as PHP code. This results in arbitrary PHP code execution on the server.

Detection Guidance

Check the installed version of the Affiliate Toolkit plugin. If it is between 3.8.7 and 3.9.0, the system is vulnerable. Use WordPress admin panel or run: wp plugin list --name=affiliate-toolkit to verify the version.

Impact Analysis

An attacker with Contributor role or higher could execute arbitrary PHP code on the server, potentially leading to full system compromise, data theft, or further attacks on the WordPress site or hosting environment.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update the Affiliate Toolkit plugin to version 3.9.1 or later immediately. Remove or restrict access for users with Contributor role or higher until the update is applied.

Hi! I’m here to help you understand CVE-2026-86787. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70