CVE-2026-6169
Remote Code Execution in Affiliate Toolkit WordPress Plugin
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| affiliate-toolkit | affiliate-toolkit | to 3.8.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The affiliate-toolkit plugin for WordPress has a vulnerability that allows remote code execution in all versions up to and including 3.8.5.
This happens because the plugin uses the BladeOne templating engine's runString() method, which compiles user-supplied template content into PHP code and executes it using eval() without proper sanitization or sandboxing.
As a result, authenticated attackers with Editor-level access or higher can inject arbitrary PHP code into a plugin template and execute it on the server.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows attackers to execute arbitrary code on the server remotely.
An attacker with Editor-level access or above can leverage this flaw to take control of the server, potentially leading to data theft, site defacement, or further compromise of the hosting environment.
The CVSS score of 7.2 indicates a high severity, with impacts on confidentiality, integrity, and availability.