CVE-2026-110179
Received Received - Intake

SQL Injection in Affiliate Toolkit WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: WPScan

Description
The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110179
EUVD
EUVD-2026-102697

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown affiliate-toolkit 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in the WordPress plugin affiliate-toolkit versions before 3.8.9. It occurs because the plugin does not properly validate a user-supplied sort value in a database query. Users with editor-level access or higher can exploit this to perform SQL injection and access sensitive database information.

Detection Guidance

Check the installed version of the affiliate-toolkit plugin. If it is below 3.8.9, the system is vulnerable. Use WordPress admin dashboard or run a command like 'wp plugin list' if using WP-CLI to verify the version.

Impact Analysis

Users with editor-level access or higher can exploit this to read arbitrary information from the database. On multisite installations, a sub-site editor could access the network-wide users table, including the super administrator's password hash.

Mitigation Strategies

Update the affiliate-toolkit plugin to version 3.8.9 or later immediately. If updating is not possible, restrict editor-level and higher user roles to prevent exploitation until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart