CVE-2026-6169
Deferred Deferred - Pending Action
Remote Code Execution in Affiliate Toolkit WordPress Plugin

Publication date: 2026-05-27

Last updated on: 2026-05-27

Assigner: Wordfence

Description
The affiliate-toolkit plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 3.8.5. This is due to the plugin using the BladeOne templating engine's runString() method which compiles user-supplied template content into PHP code and executes it via eval() without sanitization or sandboxing. This makes it possible for authenticated attackers, with Editor-level access and above, to execute arbitrary code on the server by injecting PHP into a plugin template.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-05-27
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-6169
EUVD
EUVD-2026-32105
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
affiliate-toolkit affiliate-toolkit to 3.8.5 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The affiliate-toolkit plugin for WordPress has a vulnerability that allows remote code execution in all versions up to and including 3.8.5.

This happens because the plugin uses the BladeOne templating engine's runString() method, which compiles user-supplied template content into PHP code and executes it using eval() without proper sanitization or sandboxing.

As a result, authenticated attackers with Editor-level access or higher can inject arbitrary PHP code into a plugin template and execute it on the server.

Impact Analysis

This vulnerability can have severe impacts because it allows attackers to execute arbitrary code on the server remotely.

An attacker with Editor-level access or above can leverage this flaw to take control of the server, potentially leading to data theft, site defacement, or further compromise of the hosting environment.

The CVSS score of 7.2 indicates a high severity, with impacts on confidentiality, integrity, and availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6169. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart