CVE-2026-6169
Received Received - Intake
Remote Code Execution in Affiliate Toolkit WordPress Plugin

Publication date: 2026-05-27

Last updated on: 2026-05-27

Assigner: Wordfence

Description
The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-05-27
Generated
2026-05-27
AI Q&A
2026-05-27
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
affiliate-toolkit affiliate-toolkit to 3.8.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The affiliate-toolkit plugin for WordPress has a vulnerability that allows remote code execution in all versions up to and including 3.8.5.

This happens because the plugin uses the BladeOne templating engine's runString() method, which compiles user-supplied template content into PHP code and executes it using eval() without proper sanitization or sandboxing.

As a result, authenticated attackers with Editor-level access or higher can inject arbitrary PHP code into a plugin template and execute it on the server.


How can this vulnerability impact me? :

This vulnerability can have severe impacts because it allows attackers to execute arbitrary code on the server remotely.

An attacker with Editor-level access or above can leverage this flaw to take control of the server, potentially leading to data theft, site defacement, or further compromise of the hosting environment.

The CVSS score of 7.2 indicates a high severity, with impacts on confidentiality, integrity, and availability.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart